diff --git a/Gemfile b/Gemfile
index 2fbab66d..a40534cb 100644
--- a/Gemfile
+++ b/Gemfile
@@ -15,7 +15,7 @@ gem 'devise_ldap_authenticatable' #, github: 'cschiewek/devise_ldap_authenticata
 gem 'pg'
 gem "passenger", ">= 5.0.25", require: "phusion_passenger/rack_handler"
 
-gem 'rexml', '3.2.6' # NOTE: v3.2.7 and up seem to be broken for now
+gem 'rexml', '3.3.9' # NOTE: v3.2.7 and up seem to be broken for now
 # see https://github.com/ruby/rexml/issues/142, https://github.com/ruby/rexml/issues/131
 
 gem 'yaml_db' # used to dump database to YAML
diff --git a/Gemfile.lock b/Gemfile.lock
index 312126d2..14c5a86d 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -285,7 +285,7 @@ GEM
     responders (3.1.0)
       actionpack (>= 5.2)
       railties (>= 5.2)
-    rexml (3.2.6)
+    rexml (3.3.9)
     rouge (4.1.2)
     ruby-progressbar (1.13.0)
     rubyzip (2.3.2)
@@ -406,7 +406,7 @@ DEPENDENCIES
   rack
   rails (~> 7.0.6)
   rails-controller-testing
-  rexml (= 3.2.6)
+  rexml (= 3.3.9)
   rouge
   rubyzip
   sassc-rails