diff --git a/.changeset/dependabot-adaba58.md b/.changeset/dependabot-adaba58.md
new file mode 100644
index 0000000000..b10abe506a
--- /dev/null
+++ b/.changeset/dependabot-adaba58.md
@@ -0,0 +1,8 @@
+---
+'@backstage/backend-common': patch
+'@backstage/plugin-app-backend': patch
+'@backstage/plugin-graphql-backend': patch
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+chore(deps): bump `helmet` from 4.4.1 to 5.0.2
diff --git a/.changeset/seven-birds-eat.md b/.changeset/seven-birds-eat.md
new file mode 100644
index 0000000000..1aa6cd4fff
--- /dev/null
+++ b/.changeset/seven-birds-eat.md
@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-rollbar-backend': patch
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Removed unused `helmet` dependency.
diff --git a/packages/backend-common/package.json b/packages/backend-common/package.json
index 2d33daa4d3..092a8b1ea7 100644
--- a/packages/backend-common/package.json
+++ b/packages/backend-common/package.json
@@ -57,7 +57,7 @@
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
     "git-url-parse": "^11.6.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "isomorphic-git": "^1.8.0",
     "jose": "^1.27.1",
     "keyv": "^4.0.3",
diff --git a/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts b/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts
index d155287b34..105704159b 100644
--- a/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts
+++ b/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts
@@ -19,7 +19,7 @@ import compression from 'compression';
 import cors from 'cors';
 import express, { Router, ErrorRequestHandler } from 'express';
 import helmet from 'helmet';
-import { ContentSecurityPolicyOptions } from 'helmet/dist/middlewares/content-security-policy';
+import { ContentSecurityPolicyOptions } from 'helmet/dist/types/middlewares/content-security-policy';
 import * as http from 'http';
 import stoppable from 'stoppable';
 import { Logger } from 'winston';
@@ -215,8 +215,17 @@ export class ServiceBuilderImpl implements ServiceBuilder {
       httpsSettings: this.httpsSettings,
       helmetOptions: {
         contentSecurityPolicy: {
+          useDefaults: false,
           directives: applyCspDirectives(this.cspOptions),
         },
+        // These are all disabled in order to maintain backwards compatibility
+        // when bumping helmet v5. We can't enable these by default because
+        // there is no way for users to configure them.
+        // TODO(Rugvip): We should give control of this setup to consumers
+        crossOriginEmbedderPolicy: false,
+        crossOriginOpenerPolicy: false,
+        crossOriginResourcePolicy: false,
+        originAgentCluster: false,
       },
     };
   }
@@ -232,6 +241,11 @@ export function applyCspDirectives(
   //               It should be replaced by any other solution that doesn't require unsafe-eval.
   result['script-src'] = ["'self'", "'unsafe-eval'"];
 
+  // TODO(Rugvip): This is removed so that we maintained backwards compatibility
+  //               when bumping to helmet v5, we could remove this as well as
+  //               skip setting `useDefaults: false` in the future.
+  delete result['form-action'];
+
   if (directives) {
     for (const [key, value] of Object.entries(directives)) {
       if (value === false) {
diff --git a/plugins/app-backend/package.json b/plugins/app-backend/package.json
index d04afa6874..8821171df4 100644
--- a/plugins/app-backend/package.json
+++ b/plugins/app-backend/package.json
@@ -42,7 +42,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "knex": "^1.0.2",
     "lodash": "^4.17.21",
     "luxon": "^2.0.2",
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index 84ba85e8a9..422683a09e 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -51,7 +51,6 @@
     "express-session": "^1.17.1",
     "fs-extra": "9.1.0",
     "google-auth-library": "^7.6.1",
-    "helmet": "^4.0.0",
     "jose": "^1.27.1",
     "jwt-decode": "^3.1.0",
     "knex": "^1.0.2",
diff --git a/plugins/graphql-backend/package.json b/plugins/graphql-backend/package.json
index 029963cdf6..acc9749da6 100644
--- a/plugins/graphql-backend/package.json
+++ b/plugins/graphql-backend/package.json
@@ -45,7 +45,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "graphql": "^16.0.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "reflect-metadata": "^0.1.13",
     "winston": "^3.2.1",
     "yn": "^4.0.0"
diff --git a/plugins/kubernetes-backend/package.json b/plugins/kubernetes-backend/package.json
index 9ce1634f83..bf3915bd2a 100644
--- a/plugins/kubernetes-backend/package.json
+++ b/plugins/kubernetes-backend/package.json
@@ -50,7 +50,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
+    "helmet": "^5.0.2",
     "lodash": "^4.17.21",
     "morgan": "^1.10.0",
     "stream-buffers": "^3.0.2",
diff --git a/plugins/rollbar-backend/package.json b/plugins/rollbar-backend/package.json
index bd2c548a3c..91a4d38c31 100644
--- a/plugins/rollbar-backend/package.json
+++ b/plugins/rollbar-backend/package.json
@@ -43,7 +43,6 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "9.1.0",
-    "helmet": "^4.0.0",
     "lodash": "^4.17.21",
     "morgan": "^1.10.0",
     "node-fetch": "^2.6.7",
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index ff2063bfca..69e3e16f5d 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -58,7 +58,6 @@
     "git-url-parse": "^11.6.0",
     "globby": "^11.0.0",
     "handlebars": "^4.7.6",
-    "helmet": "^4.0.0",
     "isbinaryfile": "^4.0.8",
     "isomorphic-git": "^1.8.0",
     "jsonschema": "^1.2.6",
diff --git a/yarn.lock b/yarn.lock
index 193f639f0a..0132513fc0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -13317,10 +13317,10 @@ headers-utils@^3.0.2:
   resolved "https://registry.npmjs.org/headers-utils/-/headers-utils-3.0.2.tgz#dfc65feae4b0e34357308aefbcafa99c895e59ef"
   integrity sha512-xAxZkM1dRyGV2Ou5bzMxBPNLoRCjcX+ya7KSWybQD2KwLphxsapUVK6x/02o7f4VU6GPSXch9vNY2+gkU8tYWQ==
 
-helmet@^4.0.0:
-  version "4.4.1"
-  resolved "https://registry.npmjs.org/helmet/-/helmet-4.4.1.tgz#a17e1444d81d7a83ddc6e6f9bc6e2055b994efe7"
-  integrity sha512-G8tp0wUMI7i8wkMk2xLcEvESg5PiCitFMYgGRc/PwULB0RVhTP5GFdxOwvJwp9XVha8CuS8mnhmE8I/8dx/pbw==
+helmet@^5.0.2:
+  version "5.0.2"
+  resolved "https://registry.npmjs.org/helmet/-/helmet-5.0.2.tgz#3264ec6bab96c82deaf65e3403c369424cb2366c"
+  integrity sha512-QWlwUZZ8BtlvwYVTSDTBChGf8EOcQ2LkGMnQJxSzD1mUu8CCjXJZq/BXP8eWw4kikRnzlhtYo3lCk0ucmYA3Vg==
 
 hexoid@1.0.0:
   version "1.0.0"