diff --git a/WORKSPACE b/WORKSPACE
index a833de838..7438bb825 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -72,7 +72,7 @@ _py_gazelle_deps()
 # Install twine for our own runfiles wheel publishing.
 # Eventually we might want to install twine automatically for users too, see:
 # https://github.com/bazelbuild/rules_python/issues/1016.
-load("@python//3.11.1:defs.bzl", "interpreter")
+load("@python//3.11.4:defs.bzl", "interpreter")
 load("@rules_python//python:pip.bzl", "pip_parse")
 
 pip_parse(
diff --git a/python/versions.bzl b/python/versions.bzl
index 8e289961d..1ef317258 100644
--- a/python/versions.bzl
+++ b/python/versions.bzl
@@ -287,9 +287,9 @@ TOOL_VERSIONS = {
 # buildifier: disable=unsorted-dict-items
 MINOR_MAPPING = {
     "3.8": "3.8.15",
-    "3.9": "3.9.16",
-    "3.10": "3.10.9",
-    "3.11": "3.11.1",
+    "3.9": "3.9.17",
+    "3.10": "3.10.12",
+    "3.11": "3.11.4",
 }
 
 PLATFORMS = {