diff --git a/requirements-dev.txt b/requirements-dev.txt
index 7f5da9c..e656b21 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,39 +1,38 @@
 # DO NOT EDIT THIS FILE DIRECTLY - use ./script/update-requirements to update
 Pygments==2.17.2
-black==24.3.0
-build==1.1.1
+black==24.4.0
+build==1.2.1
 cffi==1.16.0
 click==8.1.7
 cmarkgfm==2024.1.14
 coverage==7.4.4
 docutils==0.20.1
-exceptiongroup==1.2.0
 importlib_metadata==7.1.0
 iniconfig==2.0.0
 isort==5.13.2
-jaraco.classes==3.3.1
-keyring==24.3.1
+jaraco.classes==3.4.0
+jaraco.context==5.3.0
+jaraco.functools==4.0.0
+keyring==25.1.0
 markdown-it-py==3.0.0
 mdurl==0.1.2
 more-itertools==10.2.0
 mypy-extensions==1.0.0
-nh3==0.2.15
+nh3==0.2.17
 packaging==24.0
 pathspec==0.12.1
 pkginfo==1.10.0
 platformdirs==4.2.0
 pluggy==1.4.0
-pycparser==2.21
+pycparser==2.22
 pyflakes==3.2.0
 pyproject_hooks==1.0.0
-pytest-cov==4.1.0
+pytest-cov==5.0.0
 pytest-network==0.0.1
 pytest==8.1.1
 readme_renderer==43.0
 requests-toolbelt==1.0.0
 rfc3986==2.0.0
 rich==13.7.1
-tomli==2.0.1
 twine==5.0.0
-typing_extensions==4.10.0
 zipp==3.18.1
diff --git a/requirements.txt b/requirements.txt
index 10f1a8b..cdbbeeb 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,7 +4,7 @@ certifi==2024.2.2
 charset-normalizer==3.3.2
 dnspython==2.6.1
 fqdn==1.5.1
-idna==3.6
+idna==3.7
 natsort==8.4.0
 ns1-python==0.19.0
 octodns==1.6.1
diff --git a/setup.py b/setup.py
index 056c5f4..7413c80 100755
--- a/setup.py
+++ b/setup.py
@@ -35,6 +35,9 @@ def version():
             # https://black.readthedocs.io/en/stable/the_black_code_style/index.html#stability-policy
             'black>=24.3.0,<25.0.0',
             'build>=0.7.0',
+            # docutils 0.21.x bumped to >=3.9 and 3.8 is still active. we'll
+            # have to clamp it down until we remove 3.8
+            'docutils<=0.20.1',
             'isort>=5.11.5',
             'pyflakes>=2.2.0',
             'readme_renderer[md]>=26.0',