diff --git a/Cargo.lock b/Cargo.lock
index 410d52d248d12..fc7048b4004fa 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -931,9 +931,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "3.2.8"
+version = "3.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190814073e85d238f31ff738fcb0bf6910cedeb73376c87cd69291028966fd83"
+checksum = "a3dbbb6653e7c55cc8595ad3e1f7be8f32aba4eb7ff7f0fd1163d4f3d137c0a9"
 dependencies = [
  "atty",
  "bitflags",
@@ -949,9 +949,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "3.2.7"
+version = "3.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "759bf187376e1afa7b85b959e6a664a3e7a95203415dba952ad19139e798f902"
+checksum = "9ba52acd3b0a5c33aeada5cdaa3267cdc7c594a98731d4268cdc1532f4264cb4"
 dependencies = [
  "heck",
  "proc-macro-error",
diff --git a/src/billing-demo/Cargo.toml b/src/billing-demo/Cargo.toml
index 56c69b0228850..c1aee7942aecf 100644
--- a/src/billing-demo/Cargo.toml
+++ b/src/billing-demo/Cargo.toml
@@ -9,7 +9,7 @@ publish = false
 [dependencies]
 anyhow = "1.0.58"
 chrono = { version = "0.4.0", default-features = false, features = ["clock", "std"] }
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 hex = "0.4.3"
 mz-ore = { path = "../../src/ore", features = ["task"] }
 mz-test-util = { path = "../../test/test-util" }
diff --git a/src/compute/Cargo.toml b/src/compute/Cargo.toml
index 865de0cfc7c36..1b709cafd6c00 100644
--- a/src/compute/Cargo.toml
+++ b/src/compute/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
 anyhow = "1.0.58"
 async-trait = "0.1.56"
 axum = "0.5.12"
-clap = { version = "3.2.8", features = ["derive", "env"] }
+clap = { version = "3.2.16", features = ["derive", "env"] }
 crossbeam-channel = "0.5.5"
 dec = { version = "0.4.8", features = ["serde"] }
 differential-dataflow = { git = "https://github.com/TimelyDataflow/differential-dataflow.git" }
diff --git a/src/environmentd/Cargo.toml b/src/environmentd/Cargo.toml
index f72638738dd6a..6e322e3ba01bc 100644
--- a/src/environmentd/Cargo.toml
+++ b/src/environmentd/Cargo.toml
@@ -16,7 +16,7 @@ axum = { version = "0.5.12", features = ["headers"] }
 base64 = "0.13.0"
 bytes = "1.1.0"
 chrono = { version = "0.4.0", default-features = false, features = ["std"] }
-clap = { version = "3.2.8", features = ["wrap_help", "env", "derive"] }
+clap = { version = "3.2.16", features = ["wrap_help", "env", "derive"] }
 fail = { version = "0.5.0", features = ["failpoints"] }
 futures = "0.3.21"
 headers = "0.3.7"
diff --git a/src/kafka-util/Cargo.toml b/src/kafka-util/Cargo.toml
index c929093156648..db431e208cabb 100644
--- a/src/kafka-util/Cargo.toml
+++ b/src/kafka-util/Cargo.toml
@@ -9,7 +9,7 @@ publish = false
 [dependencies]
 anyhow = "1.0.58"
 chrono = { version = "0.4.0", default-features = false, features = ["std"] }
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 crossbeam = "0.8.1"
 mz-avro = { path = "../avro" }
 mz-ccsr = { path = "../ccsr" }
diff --git a/src/orchestrator-kubernetes/Cargo.toml b/src/orchestrator-kubernetes/Cargo.toml
index f832e0e694a7c..adf9637336823 100644
--- a/src/orchestrator-kubernetes/Cargo.toml
+++ b/src/orchestrator-kubernetes/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
 anyhow = "1.0.58"
 async-trait = "0.1.56"
 chrono = { version = "0.4.19", default_features = false }
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 futures = "0.3.21"
 mz-orchestrator = { path = "../orchestrator" }
 k8s-openapi = { version = "0.15.0", features = ["v1_22"] }
diff --git a/src/orchestrator-tracing/Cargo.toml b/src/orchestrator-tracing/Cargo.toml
index 455a3837fdff3..893a60e854609 100644
--- a/src/orchestrator-tracing/Cargo.toml
+++ b/src/orchestrator-tracing/Cargo.toml
@@ -9,7 +9,7 @@ publish = false
 [dependencies]
 anyhow = "1.0.58"
 async-trait = "0.1.56"
-clap = { version = "3.2.8", features = ["env", "derive"] }
+clap = { version = "3.2.16", features = ["env", "derive"] }
 futures-core = "0.3.21"
 http = "0.2.8"
 mz-orchestrator = { path = "../orchestrator" }
diff --git a/src/ore/Cargo.toml b/src/ore/Cargo.toml
index 12ef8d572790b..ca6e08612096e 100644
--- a/src/ore/Cargo.toml
+++ b/src/ore/Cargo.toml
@@ -18,7 +18,7 @@ anyhow = { version = "1.0.58", optional = true }
 async-trait = { version = "0.1.56", optional = true }
 bytes = { version = "1.1.0", optional = true }
 chrono = { version = "0.4.0", default-features = false, features = ["std"], optional = true }
-clap = { version = "3.2.8", features = ["env"], optional = true }
+clap = { version = "3.2.16", features = ["env"], optional = true }
 ctor = { version = "0.1.22", optional = true }
 either = "1.7.0"
 futures = { version = "0.3.21", optional = true }
diff --git a/src/persist-client/Cargo.toml b/src/persist-client/Cargo.toml
index 59add023c22ce..073bce78171d1 100644
--- a/src/persist-client/Cargo.toml
+++ b/src/persist-client/Cargo.toml
@@ -57,7 +57,7 @@ tokio-console = ["mz-ore/tokio-console"]
 [dev-dependencies]
 async-trait = "0.1.56"
 axum = "0.5.12"
-clap = { version = "3.2.8", features = ["derive", "env"] }
+clap = { version = "3.2.16", features = ["derive", "env"] }
 criterion = { git = "https://github.com/MaterializeInc/criterion.rs.git", features = ["html_reports"] }
 datadriven = { version = "0.6.0", features = ["async"] }
 futures-task = "0.3.21"
diff --git a/src/pgtest/Cargo.toml b/src/pgtest/Cargo.toml
index 922c2b4c80084..868880655f5a5 100644
--- a/src/pgtest/Cargo.toml
+++ b/src/pgtest/Cargo.toml
@@ -9,7 +9,7 @@ publish = false
 [dependencies]
 anyhow = "1.0.58"
 bytes = "1.1.0"
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 datadriven = "0.6.0"
 fallible-iterator = "0.2.0"
 mz-ore = { path = "../ore" }
diff --git a/src/s3-datagen/Cargo.toml b/src/s3-datagen/Cargo.toml
index 010aaf6bdd044..1b1f0fe9f4085 100644
--- a/src/s3-datagen/Cargo.toml
+++ b/src/s3-datagen/Cargo.toml
@@ -11,7 +11,7 @@ anyhow = "1.0.58"
 aws-config = { version = "0.15.0", default-features = false, features = ["native-tls"] }
 aws-sdk-s3 = { version = "0.15.0", default-features = false, features = ["native-tls", "rt-tokio"] }
 bytefmt = "0.1.7"
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 futures = "0.3.21"
 indicatif = "0.16.2"
 mz-ore = { path = "../ore" }
diff --git a/src/sqllogictest/Cargo.toml b/src/sqllogictest/Cargo.toml
index 3646d353795ca..3ccb8dc050c7e 100644
--- a/src/sqllogictest/Cargo.toml
+++ b/src/sqllogictest/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
 anyhow = "1.0.58"
 bytes = "1.1.0"
 chrono = { version = "0.4.0", default-features = false, features = ["clock", "std"] }
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 fallible-iterator = "0.2.0"
 futures = "0.3.21"
 junit-report = "0.7.1"
diff --git a/src/storaged/Cargo.toml b/src/storaged/Cargo.toml
index c59f11dbc9528..a0c49277f70fb 100644
--- a/src/storaged/Cargo.toml
+++ b/src/storaged/Cargo.toml
@@ -9,7 +9,7 @@ publish = false
 [dependencies]
 anyhow = "1.0.58"
 axum = "0.5.12"
-clap = { version = "3.2.8", features = ["derive", "env"] }
+clap = { version = "3.2.16", features = ["derive", "env"] }
 futures = "0.3.21"
 mz-build-info = { path = "../build-info" }
 mz-http-util = { path = "../http-util" }
diff --git a/src/testdrive/Cargo.toml b/src/testdrive/Cargo.toml
index ea5af366fc213..88c8aab81ef3b 100644
--- a/src/testdrive/Cargo.toml
+++ b/src/testdrive/Cargo.toml
@@ -21,7 +21,7 @@ aws-types = { version = "0.15.0", features = ["hardcoded-credentials"] }
 byteorder = "1.4.3"
 bytes = "1.1.0"
 chrono = { version = "0.4.0", default-features = false, features = ["std"] }
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 flate2 = "1.0.24"
 futures = "0.3.21"
 globset = "0.4.9"
diff --git a/test/perf-kinesis/Cargo.toml b/test/perf-kinesis/Cargo.toml
index ca9cf65251d98..5356dfc6a96a2 100644
--- a/test/perf-kinesis/Cargo.toml
+++ b/test/perf-kinesis/Cargo.toml
@@ -11,7 +11,7 @@ anyhow = "1.0.58"
 aws-config = { version = "0.15.0", default-features = false, features = ["native-tls"] }
 aws-sdk-kinesis = { version = "0.15.0", default-features = false, features = ["native-tls", "rt-tokio"] }
 bytes = "1.1.0"
-clap = { version = "3.2.8", features = ["derive"] }
+clap = { version = "3.2.16", features = ["derive"] }
 futures = "0.3.21"
 mz-kinesis-util = { path = "../../src/kinesis-util" }
 mz-ore = { path = "../../src/ore", features = ["task"] }