diff --git a/pyproject.toml b/pyproject.toml
index 1a71298..580d5cb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -39,7 +39,7 @@ cdk = [
     "constructs==10.6.0",
     "aws-cdk-aws-lambda-python-alpha==2.258.1a0",
     "cdk-monitoring-constructs==10.1.0",
-    "cdk-nag==2.38.2",
+    "cdk-nag==3.0.1",
 ]
 
 # Test runner — environment-agnostic; pairs with either `lambda` (unit tests,