diff --git a/api.planx.uk/helpers.ts b/api.planx.uk/helpers.ts
index 1a739570f8..75276f782a 100644
--- a/api.planx.uk/helpers.ts
+++ b/api.planx.uk/helpers.ts
@@ -1,5 +1,5 @@
 import { gql } from "graphql-request";
-import lodash from "lodash";
+import capitalize from "lodash/capitalize.js";
 import { Flow, Node } from "./types.js";
 import { ComponentType, FlowGraph } from "@opensystemslab/planx-core/types";
 import { $public, getClient } from "./client/index.js";
@@ -347,7 +347,7 @@ const getFormattedEnvironment = (): string => {
   if (environment === "development") {
     environment = "local";
   }
-  return lodash.capitalize(environment);
+  return capitalize(environment);
 };
 
 export {
diff --git a/api.planx.uk/jest.config.ts b/api.planx.uk/jest.config.ts
index 83139c4dd4..40944444de 100644
--- a/api.planx.uk/jest.config.ts
+++ b/api.planx.uk/jest.config.ts
@@ -15,6 +15,8 @@ const config: JestConfigWithTsJest = {
       },
     ],
   },
+  // mime v4 (which moves to pure ESM) may still have commonJS traces, so we transform it
+  transformIgnorePatterns: ["node_modules\\/.pnpm\\/(?!(mime))"],
   testPathIgnorePatterns: ["dist/*"],
   setupFilesAfterEnv: ["./jest.setup.js"],
   // handle .ts files first, as ESM modules, and remove .js from imports for jest
diff --git a/api.planx.uk/modules/auth/service.ts b/api.planx.uk/modules/auth/service.ts
index 4897cdde8d..195b2df140 100644
--- a/api.planx.uk/modules/auth/service.ts
+++ b/api.planx.uk/modules/auth/service.ts
@@ -1,4 +1,4 @@
-import jsonwebtoken from "jsonwebtoken";
+import jwt from "jsonwebtoken";
 import { $api } from "../../client/index.js";
 import { User, Role } from "@opensystemslab/planx-core/types";
 
@@ -13,12 +13,11 @@ export const buildJWT = async (email: string): Promise<string | undefined> => {
     "https://hasura.io/jwt/claims": generateHasuraClaimsForUser(user),
   };
 
-  const jwt = jsonwebtoken.sign(data, process.env.JWT_SECRET!);
-  return jwt;
+  return jwt.sign(data, process.env.JWT_SECRET!);
 };
 
 export const buildJWTForAPIRole = () =>
-  jsonwebtoken.sign(
+  jwt.sign(
     {
       "https://hasura.io/jwt/claims": {
         "x-hasura-allowed-roles": ["api"],
diff --git a/api.planx.uk/modules/gis/service/index.js b/api.planx.uk/modules/gis/service/index.js
index 8857a2f132..da53b7b081 100644
--- a/api.planx.uk/modules/gis/service/index.js
+++ b/api.planx.uk/modules/gis/service/index.js
@@ -2,14 +2,7 @@ import * as digitalLand from "./digitalLand.js";
 import * as scotland from "./local_authorities/scotland.js";
 import * as braintree from "./local_authorities/braintree.js";
 
-const localAuthorities = {
-  // braintree: await import("./local_authorities/braintree.js"),
-  // scotland: await import("./local_authorities/scotland.js"),
-  // digitalLand: await import("./digitalLand.js"),
-  digitalLand,
-  braintree,
-  scotland,
-};
+const localAuthorities = { digitalLand, braintree, scotland };
 
 /**
  * @swagger
diff --git a/api.planx.uk/modules/saveAndReturn/service/validateSession.test.ts b/api.planx.uk/modules/saveAndReturn/service/validateSession.test.ts
index 8c4ec69e91..b27d09948c 100644
--- a/api.planx.uk/modules/saveAndReturn/service/validateSession.test.ts
+++ b/api.planx.uk/modules/saveAndReturn/service/validateSession.test.ts
@@ -1,5 +1,5 @@
 import supertest from "supertest";
-import lodash from "lodash";
+import omit from "lodash/omit.js";
 import app from "../../../server.js";
 import { queryMock } from "../../../tests/graphqlQueryMock.js";
 import {
@@ -22,7 +22,7 @@ const validateSessionPath = "/validate-session";
 const getStoreMock = jest.spyOn(userContext, "getStore");
 
 describe("Validate Session endpoint", () => {
-  const reconciledData = lodash.omit(mockLowcalSession.data, "passport");
+  const reconciledData = omit(mockLowcalSession.data, "passport");
 
   beforeEach(() => {
     getStoreMock.mockReturnValue({
diff --git a/api.planx.uk/modules/saveAndReturn/service/validateSession.ts b/api.planx.uk/modules/saveAndReturn/service/validateSession.ts
index 875dc00b68..f62cf1cf50 100644
--- a/api.planx.uk/modules/saveAndReturn/service/validateSession.ts
+++ b/api.planx.uk/modules/saveAndReturn/service/validateSession.ts
@@ -1,5 +1,5 @@
 import { gql } from "graphql-request";
-import lodash from "lodash";
+import omit from "lodash/omit.js";
 import { getMostRecentPublishedFlow } from "../../../helpers.js";
 import { sortBreadcrumbs } from "@opensystemslab/planx-core";
 import { ComponentType } from "@opensystemslab/planx-core/types";
@@ -29,7 +29,7 @@ export async function validateSession(
   sessionId: string,
   fetchedSession: Partial<LowCalSession>,
 ) {
-  const sessionData = lodash.omit(fetchedSession.data!, "passport");
+  const sessionData = omit(fetchedSession.data!, "passport");
   const sessionUpdatedAt = fetchedSession.updated_at!;
   const flowId = fetchedSession.flow_id!;
 
diff --git a/api.planx.uk/modules/webhooks/service/validateInput/utils.ts b/api.planx.uk/modules/webhooks/service/validateInput/utils.ts
index 0364dcd202..1ce7596936 100644
--- a/api.planx.uk/modules/webhooks/service/validateInput/utils.ts
+++ b/api.planx.uk/modules/webhooks/service/validateInput/utils.ts
@@ -1,4 +1,4 @@
-import lodash from "lodash";
+import isObject from "lodash/isObject.js";
 import { JSDOM } from "jsdom";
 import createDOMPurify from "dompurify";
 import he from "he";
@@ -27,7 +27,7 @@ export const isObjectValid = (
     return input.every((child) => isObjectValid(child, validator));
   }
 
-  if (lodash.isObject(input)) {
+  if (isObject(input)) {
     return Object.values(input).every((child) =>
       isObjectValid(child, validator),
     );
diff --git a/api.planx.uk/package.json b/api.planx.uk/package.json
index c24c67ee29..6057cb4696 100644
--- a/api.planx.uk/package.json
+++ b/api.planx.uk/package.json
@@ -41,7 +41,7 @@
     "jsondiffpatch": "^0.5.0",
     "jsonwebtoken": "^9.0.2",
     "lodash": "^4.17.21",
-    "mime": "^3.0.0",
+    "mime": "^4.0.4",
     "multer": "^1.4.5-lts.1",
     "nanoid": "^3.3.7",
     "notifications-node-client": "^8.2.0",
@@ -91,7 +91,6 @@
     "@types/jsdom": "^21.1.6",
     "@types/jsonwebtoken": "^9.0.5",
     "@types/lodash": "^4.17.0",
-    "@types/mime": "^3.0.4",
     "@types/multer": "^1.4.11",
     "@types/node": "^18.19.13",
     "@types/passport": "^1.0.16",
diff --git a/api.planx.uk/pnpm-lock.yaml b/api.planx.uk/pnpm-lock.yaml
index 1ab23ca74f..0293e00482 100644
--- a/api.planx.uk/pnpm-lock.yaml
+++ b/api.planx.uk/pnpm-lock.yaml
@@ -104,8 +104,8 @@ dependencies:
     specifier: ^4.17.21
     version: 4.17.21
   mime:
-    specifier: ^3.0.0
-    version: 3.0.0
+    specifier: ^4.0.4
+    version: 4.0.4
   multer:
     specifier: ^1.4.5-lts.1
     version: 1.4.5-lts.1
@@ -192,9 +192,6 @@ devDependencies:
   '@types/lodash':
     specifier: ^4.17.0
     version: 4.17.0
-  '@types/mime':
-    specifier: ^3.0.4
-    version: 3.0.4
   '@types/multer':
     specifier: ^1.4.11
     version: 1.4.11
@@ -2164,10 +2161,6 @@ packages:
   /@types/mime@1.3.5:
     resolution: {integrity: sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==}
 
-  /@types/mime@3.0.4:
-    resolution: {integrity: sha512-iJt33IQnVRkqeqC7PzBHPTC6fDlRNRW8vjrgqtScAhrmMwe8c4Eo7+fUGTa+XdWrpEgpyKWMYmi2dIwMAYRzPw==}
-    dev: true
-
   /@types/multer@1.4.11:
     resolution: {integrity: sha512-svK240gr6LVWvv3YGyhLlA+6LRRWA4mnGIU7RcNmgjBYFl6665wcXrRfxGp5tEPVHUNm5FMcmq7too9bxCwX/w==}
     dependencies:
@@ -6205,9 +6198,9 @@ packages:
     hasBin: true
     dev: true
 
-  /mime@3.0.0:
-    resolution: {integrity: sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==}
-    engines: {node: '>=10.0.0'}
+  /mime@4.0.4:
+    resolution: {integrity: sha512-v8yqInVjhXyqP6+Kw4fV3ZzeMRqEW6FotRsKXjRS5VMTNIuXsdRoAvklpoRgSqXm6o9VNH4/C0mgedko9DdLsQ==}
+    engines: {node: '>=16'}
     hasBin: true
     dev: false