diff --git a/.changeset/dependabot-adaba58.md b/.changeset/dependabot-adaba58.md
new file mode 100644
index 0000000000..2721b8f8e8
--- /dev/null
+++ b/.changeset/dependabot-adaba58.md
@@ -0,0 +1,11 @@
+---
+'@backstage/backend-common': patch
+'@backstage/plugin-app-backend': patch
+'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-graphql-backend': patch
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/plugin-rollbar-backend': patch
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+chore(deps): bump `helmet` from 4.4.1 to 5.0.2
diff --git a/packages/backend-common/package.json b/packages/backend-common/package.json
index 2d33daa4d3..092a8b1ea7 100644
--- a/packages/backend-common/package.json
+++ b/packages/backend-common/package.json
@@ -57,7 +57,7 @@
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
     "git-url-parse": "^11.6.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "isomorphic-git": "^1.8.0",
     "jose": "^1.27.1",
     "keyv": "^4.0.3",
diff --git a/plugins/app-backend/package.json b/plugins/app-backend/package.json
index d04afa6874..8821171df4 100644
--- a/plugins/app-backend/package.json
+++ b/plugins/app-backend/package.json
@@ -42,7 +42,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "knex": "^1.0.2",
     "lodash": "^4.17.21",
     "luxon": "^2.0.2",
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index 84ba85e8a9..246b7bc025 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -51,7 +51,7 @@
     "express-session": "^1.17.1",
     "fs-extra": "9.1.0",
     "google-auth-library": "^7.6.1",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "jose": "^1.27.1",
     "jwt-decode": "^3.1.0",
     "knex": "^1.0.2",
diff --git a/plugins/graphql-backend/package.json b/plugins/graphql-backend/package.json
index 029963cdf6..acc9749da6 100644
--- a/plugins/graphql-backend/package.json
+++ b/plugins/graphql-backend/package.json
@@ -45,7 +45,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "graphql": "^16.0.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "reflect-metadata": "^0.1.13",
     "winston": "^3.2.1",
     "yn": "^4.0.0"
diff --git a/plugins/kubernetes-backend/package.json b/plugins/kubernetes-backend/package.json
index 9ce1634f83..bf3915bd2a 100644
--- a/plugins/kubernetes-backend/package.json
+++ b/plugins/kubernetes-backend/package.json
@@ -50,7 +50,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "lodash": "^4.17.21",
     "morgan": "^1.10.0",
     "stream-buffers": "^3.0.2",
diff --git a/plugins/rollbar-backend/package.json b/plugins/rollbar-backend/package.json
index bd2c548a3c..7ff4df1248 100644
--- a/plugins/rollbar-backend/package.json
+++ b/plugins/rollbar-backend/package.json
@@ -43,7 +43,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "lodash": "^4.17.21",
     "morgan": "^1.10.0",
     "node-fetch": "^2.6.7",
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index ff2063bfca..b190516257 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -58,7 +58,7 @@
     "git-url-parse": "^11.6.0",
     "globby": "^11.0.0",
     "handlebars": "^4.7.6",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "isbinaryfile": "^4.0.8",
     "isomorphic-git": "^1.8.0",
     "jsonschema": "^1.2.6",
diff --git a/yarn.lock b/yarn.lock
index 6d91e6a177..5ee0c46df6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -13317,10 +13317,10 @@ headers-utils@^3.0.2:
   resolved "https://registry.npmjs.org/headers-utils/-/headers-utils-3.0.2.tgz#dfc65feae4b0e34357308aefbcafa99c895e59ef"
   integrity sha512-xAxZkM1dRyGV2Ou5bzMxBPNLoRCjcX+ya7KSWybQD2KwLphxsapUVK6x/02o7f4VU6GPSXch9vNY2+gkU8tYWQ==
 
-helmet@^4.0.0:
-  version "4.4.1"
-  resolved "https://registry.npmjs.org/helmet/-/helmet-4.4.1.tgz#a17e1444d81d7a83ddc6e6f9bc6e2055b994efe7"
-  integrity sha512-G8tp0wUMI7i8wkMk2xLcEvESg5PiCitFMYgGRc/PwULB0RVhTP5GFdxOwvJwp9XVha8CuS8mnhmE8I/8dx/pbw==
+helmet@^5.0.2:
+  version "5.0.2"
+  resolved "https://registry.npmjs.org/helmet/-/helmet-5.0.2.tgz#3264ec6bab96c82deaf65e3403c369424cb2366c"
+  integrity sha512-QWlwUZZ8BtlvwYVTSDTBChGf8EOcQ2LkGMnQJxSzD1mUu8CCjXJZq/BXP8eWw4kikRnzlhtYo3lCk0ucmYA3Vg==
 
 hexoid@1.0.0:
   version "1.0.0"