diff --git a/setup.py b/setup.py
index b93a692305..cb32858f3c 100644
--- a/setup.py
+++ b/setup.py
@@ -22,7 +22,7 @@
         "flask<3",
         "Werkzeug<3.0",   # FIXME: we have passwords using plain sha1 that are undecodable after 3.0
         "Flask-Babel==4.0.0",
-        "Flask-Cors==5.0.0",
+        "Flask-Cors==6.0.0",
         "Flask-DebugToolbar==0.15.1",
         "Flask-Login==0.6.3",
         "Flask-Mail==0.10.0",