diff --git a/backend/multi-account/control-tower/requirements.in b/backend/multi-account/control-tower/requirements.in
index 939c3ec0c..a103abbbc 100644
--- a/backend/multi-account/control-tower/requirements.in
+++ b/backend/multi-account/control-tower/requirements.in
@@ -1,3 +1,3 @@
 aws-cdk-lib>=2.265.0
 constructs>=10.8.1,<11.0.0
-cdk-nag>=2.37.55,<3
+cdk-nag>=3.0.2,<4
diff --git a/backend/multi-account/control-tower/requirements.txt b/backend/multi-account/control-tower/requirements.txt
index cdeddbb56..cc708ced9 100644
--- a/backend/multi-account/control-tower/requirements.txt
+++ b/backend/multi-account/control-tower/requirements.txt
@@ -16,15 +16,15 @@ aws-cdk-cloud-assembly-schema==54.20.0
     # via aws-cdk-lib
 aws-cdk-lib==2.265.0
     # via
-    #   -r requirements.in
+    #   -r control-tower/requirements.in
     #   cdk-nag
 cattrs==25.3.0
     # via jsii
-cdk-nag==2.38.2
-    # via -r requirements.in
+cdk-nag==3.0.2
+    # via -r control-tower/requirements.in
 constructs==10.8.1
     # via
-    #   -r requirements.in
+    #   -r control-tower/requirements.in
     #   aws-cdk-lib
     #   cdk-nag
 jsii==1.139.0
@@ -51,7 +51,6 @@ six==1.17.0
 typeguard==2.13.3
     # via
     #   aws-cdk-asset-node-proxy-agent-v6
-    #   cdk-nag
     #   jsii
 typing-extensions==4.15.0
     # via