diff --git a/backend/multi-account/control-tower/requirements.in b/backend/multi-account/control-tower/requirements.in
index 939c3ec0c..a103abbbc 100644
--- a/backend/multi-account/control-tower/requirements.in
+++ b/backend/multi-account/control-tower/requirements.in
@@ -1,3 +1,3 @@
 aws-cdk-lib>=2.265.0
 constructs>=10.8.1,<11.0.0
-cdk-nag>=2.37.55,<3
+cdk-nag>=3.0.2,<4
diff --git a/backend/multi-account/control-tower/requirements.txt b/backend/multi-account/control-tower/requirements.txt
index cdeddbb56..4a0438daa 100644
--- a/backend/multi-account/control-tower/requirements.txt
+++ b/backend/multi-account/control-tower/requirements.txt
@@ -20,7 +20,7 @@ aws-cdk-lib==2.265.0
     #   cdk-nag
 cattrs==25.3.0
     # via jsii
-cdk-nag==2.38.2
+cdk-nag==3.0.2
     # via -r requirements.in
 constructs==10.8.1
     # via
@@ -51,7 +51,6 @@ six==1.17.0
 typeguard==2.13.3
     # via
     #   aws-cdk-asset-node-proxy-agent-v6
-    #   cdk-nag
     #   jsii
 typing-extensions==4.15.0
     # via