diff --git a/buck2.yaml b/buck2.yaml
index a9a7dc6e9a58..a3cca6518ac6 100644
--- a/buck2.yaml
+++ b/buck2.yaml
@@ -1,7 +1,7 @@
 package:
   name: buck2
   version: "20260102"
-  epoch: 0 # GHSA-xwfj-jgwm-7wp5|CVE-2025-58160
+  epoch: 1 # GHSA-rhfx-m35p-ff5j
   description: "Build system, successor to Buck"
   copyright:
     - license: MIT
@@ -32,6 +32,10 @@ pipeline:
       expected-commit: ebb0fba54f1f840d689a9c10f56aa7f56ae3f38d
       tag: ${{vars.mangled-package-version}}
 
+  - name: Bump dependency for CVE remediation
+    runs: |
+      sed -i 's/lru = "0\.12\.3"/lru = "0.16.3"/' Cargo.toml
+
   - name: Set up Rust
     runs: |
       # This build requires a specific version of rust nightly: rustup will