diff --git a/elt-common/pyproject.toml b/elt-common/pyproject.toml
index 9ee706a6..6572cd12 100644
--- a/elt-common/pyproject.toml
+++ b/elt-common/pyproject.toml
@@ -23,7 +23,7 @@ iceberg-maintenance = [
   "trino>=0.336.0",
   "pydantic_settings>=2.12.0",
 ]
-m365 = ["authlib>=1.6.1", "httpx>=0.28.1", "tenacity>=9.1.2"]
+m365 = ["authlib>=1.6.12", "httpx>=0.28.1", "tenacity>=9.1.2"]
 
 [project.entry-points.pytest11]
 elt_common = "elt_common.testing.fixtures"
diff --git a/elt-common/uv.lock b/elt-common/uv.lock
index f0c9415a..c4101711 100644
--- a/elt-common/uv.lock
+++ b/elt-common/uv.lock
@@ -199,14 +199,14 @@ wheels = [
 
 [[package]]
 name = "authlib"
-version = "1.6.9"
+version = "1.6.12"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/af/98/00d3dd826d46959ad8e32af2dbb2398868fd9fd0683c26e56d0789bd0e68/authlib-1.6.9.tar.gz", hash = "sha256:d8f2421e7e5980cc1ddb4e32d3f5fa659cfaf60d8eaf3281ebed192e4ab74f04", size = 165134, upload-time = "2026-03-02T07:44:01.998Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/30/6691fdc63b35f54a5a65e04fa1e59d827f4d4e8f4a39678ba7d3088ce0c8/authlib-1.6.12.tar.gz", hash = "sha256:0656d8482f28fc8221929d5f35b2bde5d13e10555ebc06b4561b0d622e83b1bd", size = 165368, upload-time = "2026-05-04T08:11:31.826Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/53/23/b65f568ed0c22f1efacb744d2db1a33c8068f384b8c9b482b52ebdbc3ef6/authlib-1.6.9-py2.py3-none-any.whl", hash = "sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3", size = 244197, upload-time = "2026-03-02T07:44:00.307Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/51/9b0b5cd4cf683a02db937a6f9bbebcdc9c56558a7bb3763ce7d3512103c3/authlib-1.6.12-py2.py3-none-any.whl", hash = "sha256:e9229ad7fde610b139dd12f5edbe97eab9ee78bfb85691247e767727850b99ab", size = 244473, upload-time = "2026-05-04T08:11:30.354Z" },
 ]
 
 [[package]]
@@ -485,7 +485,7 @@ dev = [
 
 [package.metadata]
 requires-dist = [
-    { name = "authlib", marker = "extra == 'm365'", specifier = ">=1.6.1" },
+    { name = "authlib", marker = "extra == 'm365'", specifier = ">=1.6.12" },
     { name = "click", marker = "extra == 'iceberg-maintenance'", specifier = ">=8.2.1" },
     { name = "dlt", extras = ["parquet", "s3"], specifier = ">=1.20,<2" },
     { name = "httpx", marker = "extra == 'm365'", specifier = ">=0.28.1" },