diff --git a/api.planx.uk/package.json b/api.planx.uk/package.json
index ab680ac837..1ce1b14d95 100644
--- a/api.planx.uk/package.json
+++ b/api.planx.uk/package.json
@@ -23,7 +23,7 @@
     "express-pino-logger": "^7.0.0",
     "express-rate-limit": "^7.1.5",
     "form-data": "^4.0.0",
-    "graphql": "^16.8.1",
+    "graphql": "^16.9.0",
     "graphql-request": "^4.3.0",
     "he": "^1.2.0",
     "helmet": "^7.1.0",
diff --git a/api.planx.uk/pnpm-lock.yaml b/api.planx.uk/pnpm-lock.yaml
index 89a9ab3e88..2f47d1001f 100644
--- a/api.planx.uk/pnpm-lock.yaml
+++ b/api.planx.uk/pnpm-lock.yaml
@@ -71,11 +71,11 @@ dependencies:
     specifier: ^4.0.0
     version: 4.0.0
   graphql:
-    specifier: ^16.8.1
-    version: 16.8.1
+    specifier: ^16.9.0
+    version: 16.9.0
   graphql-request:
     specifier: ^4.3.0
-    version: 4.3.0(graphql@16.8.1)
+    version: 4.3.0(graphql@16.9.0)
   he:
     specifier: ^1.2.0
     version: 1.2.0
@@ -3688,6 +3688,7 @@ packages:
 
   /eslint-config-prettier@9.1.0(eslint@8.57.0):
     resolution: {integrity: sha512-NSWl5BFQWEPi1j4TjVNItzYV7dZXZ+wP6I6ZhrBGpChQhZRUaElihE9uRRkcbRnNb76UMKDF3r+WTmNcGPKsqw==}
+    hasBin: true
     peerDependencies:
       eslint: '>=7.0.0'
     dependencies:
@@ -4427,7 +4428,7 @@ packages:
       object-hash: 1.3.1
     dev: true
 
-  /graphql-request@4.3.0(graphql@16.8.1):
+  /graphql-request@4.3.0(graphql@16.9.0):
     resolution: {integrity: sha512-2v6hQViJvSsifK606AliqiNiijb1uwWp6Re7o0RTyH+uRTv/u7Uqm2g4Fjq/LgZIzARB38RZEvVBFOQOVdlBow==}
     peerDependencies:
       graphql: 14 - 16
@@ -4435,7 +4436,7 @@ packages:
       cross-fetch: 3.1.8
       extract-files: 9.0.0
       form-data: 3.0.1
-      graphql: 16.8.1
+      graphql: 16.9.0
     transitivePeerDependencies:
       - encoding
     dev: false
@@ -4459,11 +4460,6 @@ packages:
       iterall: 1.3.0
     dev: true
 
-  /graphql@16.8.1:
-    resolution: {integrity: sha512-59LZHPdGZVh695Ud9lRzPBVTtlX9ZCV150Er2W43ro37wVof0ctenSaskPPjN7lVTIN8mSZt8PHUNKZuNQUuxw==}
-    engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0}
-    dev: false
-
   /graphql@16.9.0:
     resolution: {integrity: sha512-GGTKBX4SD7Wdb8mqeDLni2oaRGYQWjWHGKPQ24ZMnUtKfcsVoiv4uX8+LJr1K6U5VW2Lu1BwJnj7uiori0YtRw==}
     engines: {node: ^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0}
@@ -5067,6 +5063,7 @@ packages:
   /jest-cli@29.7.0(@types/node@18.19.13):
     resolution: {integrity: sha512-OVVobw2IubN/GSYsxETi+gOe7Ka59EFMR/twOU3Jb2GnKKeMGJB5SGUUrEz3SFVmJASUdZUzy83sLNNQ2gZslg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    hasBin: true
     peerDependencies:
       node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
     peerDependenciesMeta:
@@ -5487,6 +5484,7 @@ packages:
   /jest@29.7.0(@types/node@18.19.13):
     resolution: {integrity: sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    hasBin: true
     peerDependencies:
       node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
     peerDependenciesMeta:
@@ -7618,6 +7616,7 @@ packages:
   /ts-jest@29.1.1(@babel/core@7.24.0)(esbuild@0.21.4)(jest@29.7.0)(typescript@5.4.3):
     resolution: {integrity: sha512-D6xjnnbP17cC85nliwGiL+tpoKN0StpgE0TeOjXQTU6MVCfsB4v7aW05CgQ/1OywGb0x/oy9hHFnN+sczTiRaA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    hasBin: true
     peerDependencies:
       '@babel/core': '>=7.0.0-beta.0 <8'
       '@jest/types': ^29.0.0
@@ -7652,6 +7651,7 @@ packages:
   /ts-node-dev@2.0.0(@types/node@18.19.13)(typescript@5.4.3):
     resolution: {integrity: sha512-ywMrhCfH6M75yftYvrvNarLEY+SUXtUvU8/0Z6llrHQVBx12GiFk5sStF8UdfE/yfzk9IAq7O5EEbTQsxlBI8w==}
     engines: {node: '>=0.8.0'}
+    hasBin: true
     peerDependencies:
       node-notifier: '*'
       typescript: '*'
@@ -7678,6 +7678,7 @@ packages:
 
   /ts-node@10.9.2(@types/node@18.19.13)(typescript@5.4.3):
     resolution: {integrity: sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==}
+    hasBin: true
     peerDependencies:
       '@swc/core': '>=1.2.50'
       '@swc/wasm': '>=1.2.50'
@@ -7838,6 +7839,7 @@ packages:
 
   /update-browserslist-db@1.0.16(browserslist@4.23.1):
     resolution: {integrity: sha512-KVbTxlBYlckhF5wgfyZXTWnMn7MMZjMu9XG8bPlliUOP9ThaF4QnhP8qrjrH7DRzHfSk0oQv1wToW+iA5GajEQ==}
+    hasBin: true
     peerDependencies:
       browserslist: '>= 4.21.0'
     dependencies:
@@ -8195,6 +8197,7 @@ packages:
     resolution: {tarball: https://codeload.github.com/theopensystemslab/planx-core/tar.gz/b975cf9}
     name: '@opensystemslab/planx-core'
     version: 1.0.0
+    prepare: true
     requiresBuild: true
     dependencies:
       '@emotion/react': 11.11.4(react@18.3.1)