diff --git a/go.mod b/go.mod
index ed7441f..610547b 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/knadh/koanf/parsers/yaml v1.1.0
 	github.com/knadh/koanf/providers/file v1.2.1
-	github.com/knadh/koanf/v2 v2.3.2
+	github.com/knadh/koanf/v2 v2.3.3
 	github.com/samber/lo v1.52.0
 	github.com/spf13/cobra v1.10.2
 )
diff --git a/go.sum b/go.sum
index 4a30ae8..bb13219 100644
--- a/go.sum
+++ b/go.sum
@@ -19,8 +19,8 @@ github.com/knadh/koanf/parsers/yaml v1.1.0 h1:3ltfm9ljprAHt4jxgeYLlFPmUaunuCgu1y
 github.com/knadh/koanf/parsers/yaml v1.1.0/go.mod h1:HHmcHXUrp9cOPcuC+2wrr44GTUB0EC+PyfN3HZD9tFg=
 github.com/knadh/koanf/providers/file v1.2.1 h1:bEWbtQwYrA+W2DtdBrQWyXqJaJSG3KrP3AESOJYp9wM=
 github.com/knadh/koanf/providers/file v1.2.1/go.mod h1:bp1PM5f83Q+TOUu10J/0ApLBd9uIzg+n9UgthfY+nRA=
-github.com/knadh/koanf/v2 v2.3.2 h1:Ee6tuzQYFwcZXQpc2MiVeC6qHMandf5SMUJJNoFp/c4=
-github.com/knadh/koanf/v2 v2.3.2/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
+github.com/knadh/koanf/v2 v2.3.3 h1:jLJC8XCRfLC7n4F+ZKKdBsbq1bfXTpuFhf4L7t94D94=
+github.com/knadh/koanf/v2 v2.3.3/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
 github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
diff --git a/vendor/github.com/knadh/koanf/v2/koanf.go b/vendor/github.com/knadh/koanf/v2/koanf.go
index f7475d7..1b87105 100644
--- a/vendor/github.com/knadh/koanf/v2/koanf.go
+++ b/vendor/github.com/knadh/koanf/v2/koanf.go
@@ -434,15 +434,25 @@ func (ko *Koanf) Delim() string {
 
 func (ko *Koanf) merge(c map[string]any, opts *options) error {
 	ko.mu.Lock()
-	defer ko.mu.Unlock()
 
 	maps.IntfaceKeysToStrings(c)
 	if opts.merge != nil {
-		if err := opts.merge(c, ko.confMap); err != nil {
+		// Deep-copy confMap so the custom merge function can safely call
+		// ko.Get*() methods (which acquire a read lock) without deadlocking.
+		dest := maps.Copy(ko.confMap)
+
+		ko.mu.Unlock()
+		err := opts.merge(c, dest)
+		ko.mu.Lock()
+
+		if err != nil {
+			ko.mu.Unlock()
 			return err
 		}
+		ko.confMap = dest
 	} else if ko.conf.StrictMerge {
 		if err := maps.MergeStrict(c, ko.confMap); err != nil {
+			ko.mu.Unlock()
 			return err
 		}
 	} else {
@@ -453,6 +463,7 @@ func (ko *Koanf) merge(c map[string]any, opts *options) error {
 	ko.confMapFlat, ko.keyMap = maps.Flatten(ko.confMap, nil, ko.conf.Delim)
 	ko.keyMap = populateKeyParts(ko.keyMap, ko.conf.Delim)
 
+	ko.mu.Unlock()
 	return nil
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 7e1c4c5..ba38ffa 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -31,7 +31,7 @@ github.com/knadh/koanf/parsers/yaml
 # github.com/knadh/koanf/providers/file v1.2.1
 ## explicit; go 1.23.0
 github.com/knadh/koanf/providers/file
-# github.com/knadh/koanf/v2 v2.3.2
+# github.com/knadh/koanf/v2 v2.3.3
 ## explicit; go 1.23.0
 github.com/knadh/koanf/v2
 # github.com/mitchellh/copystructure v1.2.0