diff --git a/.changeset/dependabot-c0a46e9.md b/.changeset/dependabot-c0a46e9.md
new file mode 100644
index 0000000000..9242dc6692
--- /dev/null
+++ b/.changeset/dependabot-c0a46e9.md
@@ -0,0 +1,11 @@
+---
+'@backstage/backend-common': patch
+'@backstage/plugin-app-backend': patch
+'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-graphql-backend': patch
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/plugin-rollbar-backend': patch
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+build(deps): bump `helmet` from 4.4.1 to 5.0.1
diff --git a/packages/backend-common/package.json b/packages/backend-common/package.json
index f0a6f4af05..e9979ad64f 100644
--- a/packages/backend-common/package.json
+++ b/packages/backend-common/package.json
@@ -51,7 +51,7 @@
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
     "git-url-parse": "^11.6.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.1",
     "isomorphic-git": "^1.8.0",
     "jose": "^1.27.1",
     "keyv": "^4.0.3",
diff --git a/plugins/app-backend/package.json b/plugins/app-backend/package.json
index ec06cdadc4..bf7f8cc2f9 100644
--- a/plugins/app-backend/package.json
+++ b/plugins/app-backend/package.json
@@ -39,7 +39,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.1",
     "knex": "^0.95.1",
     "lodash": "^4.17.21",
     "luxon": "^2.0.2",
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index 1b23c0f59c..7000b02296 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -47,7 +47,7 @@
     "express-session": "^1.17.1",
     "fs-extra": "9.1.0",
     "google-auth-library": "^7.6.1",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.1",
     "jose": "^1.27.1",
     "jwt-decode": "^3.1.0",
     "knex": "^0.95.1",
diff --git a/plugins/graphql-backend/package.json b/plugins/graphql-backend/package.json
index ba1800e8e1..4a8ec17a99 100644
--- a/plugins/graphql-backend/package.json
+++ b/plugins/graphql-backend/package.json
@@ -42,7 +42,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "graphql": "^16.0.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.1",
     "reflect-metadata": "^0.1.13",
     "winston": "^3.2.1",
     "yn": "^4.0.0"
diff --git a/plugins/kubernetes-backend/package.json b/plugins/kubernetes-backend/package.json
index 7bad3a69c6..4fd8168aa6 100644
--- a/plugins/kubernetes-backend/package.json
+++ b/plugins/kubernetes-backend/package.json
@@ -47,7 +47,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.1",
     "lodash": "^4.17.21",
     "morgan": "^1.10.0",
     "stream-buffers": "^3.0.2",
diff --git a/plugins/rollbar-backend/package.json b/plugins/rollbar-backend/package.json
index 392b9f5436..ae445a56e4 100644
--- a/plugins/rollbar-backend/package.json
+++ b/plugins/rollbar-backend/package.json
@@ -40,7 +40,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.1",
     "lodash": "^4.17.21",
     "morgan": "^1.10.0",
     "node-fetch": "^2.6.1",
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index 643e0f9166..6ca4d2439e 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -56,7 +56,7 @@
     "git-url-parse": "^11.6.0",
     "globby": "^11.0.0",
     "handlebars": "^4.7.6",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.1",
     "isbinaryfile": "^4.0.8",
     "isomorphic-git": "^1.8.0",
     "jsonschema": "^1.2.6",
diff --git a/yarn.lock b/yarn.lock
index c49433848e..3fae97ddbc 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -16501,10 +16501,10 @@ headers-utils@^3.0.2:
   resolved "https://registry.npmjs.org/headers-utils/-/headers-utils-3.0.2.tgz#dfc65feae4b0e34357308aefbcafa99c895e59ef"
   integrity sha512-xAxZkM1dRyGV2Ou5bzMxBPNLoRCjcX+ya7KSWybQD2KwLphxsapUVK6x/02o7f4VU6GPSXch9vNY2+gkU8tYWQ==
 
-helmet@^4.0.0:
-  version "4.4.1"
-  resolved "https://registry.npmjs.org/helmet/-/helmet-4.4.1.tgz#a17e1444d81d7a83ddc6e6f9bc6e2055b994efe7"
-  integrity sha512-G8tp0wUMI7i8wkMk2xLcEvESg5PiCitFMYgGRc/PwULB0RVhTP5GFdxOwvJwp9XVha8CuS8mnhmE8I/8dx/pbw==
+helmet@^5.0.1:
+  version "5.0.1"
+  resolved "https://registry.npmjs.org/helmet/-/helmet-5.0.1.tgz#e8b2aacf881dd5cffadbb640f23155f23de485ae"
+  integrity sha512-iyYpGYH2nbQVaQtauYDnemWg45S2RyGvJ+iKj+V9jp7Dc1NTtAJHmD+hFOSYS7Xdwe1GeyVEYSydggXLOg6TKQ==
 
 highlight.js@^10.1.0, highlight.js@^10.1.1, highlight.js@^10.4.1, highlight.js@^10.6.0:
   version "10.7.2"