diff --git a/packages/files/CHANGELOG.md b/packages/files/CHANGELOG.md
index 7cf41a86..d139c2bd 100644
--- a/packages/files/CHANGELOG.md
+++ b/packages/files/CHANGELOG.md
@@ -2,7 +2,9 @@
 
 ## [Unreleased]
 
-No notable changes.
+### Changed
+
+- Bump dependency on [yaml] to 2.5.1 ([#1001](https://github.com/cerbos/cerbos-sdk-javascript/pull/1001))
 
 ## [0.2.8] - 2024-08-19
 
diff --git a/packages/files/changelog.yaml b/packages/files/changelog.yaml
index ff8beadf..c3504d87 100644
--- a/packages/files/changelog.yaml
+++ b/packages/files/changelog.yaml
@@ -1,3 +1,11 @@
+unreleased:
+  type: patch
+
+  bumped:
+    yaml:
+      to: 2.5.1
+      pull: 1001
+
 releases:
   - version: 0.2.8
     date: 2024-08-19
diff --git a/packages/files/package.json b/packages/files/package.json
index 0b5c7294..36e6263f 100644
--- a/packages/files/package.json
+++ b/packages/files/package.json
@@ -49,7 +49,7 @@
   ],
   "dependencies": {
     "@cerbos/core": "^0.18.1",
-    "yaml": "^2.5.0"
+    "yaml": "^2.5.1"
   },
   "publishConfig": {
     "access": "public",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ee327ee6..dfc20441 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -85,7 +85,7 @@ importers:
         specifier: ^0.18.1
         version: link:../core
       yaml:
-        specifier: ^2.5.0
+        specifier: ^2.5.1
         version: 2.5.1
 
   packages/grpc: