diff --git a/Gemfile b/Gemfile
index afefba8ea..947334cae 100644
--- a/Gemfile
+++ b/Gemfile
@@ -31,7 +31,7 @@ gem "yajl-ruby",   "1.4.3"
 
 # Authentication
 
-gem "devise", "4.9.2"
+gem "devise", "4.9.4"
 gem "devise_lastseenable", "0.0.6"
 gem "devise-two-factor", "4.1.0"
 gem "rqrcode", "2.2.0"
diff --git a/Gemfile.lock b/Gemfile.lock
index 80fe624dc..e23a2dd44 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -89,7 +89,7 @@ GEM
     babel-transpiler (0.7.0)
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
-    bcrypt (3.1.19)
+    bcrypt (3.1.20)
     bindata (2.4.15)
     bootstrap-sass (3.4.1)
       autoprefixer-rails (>= 5.2.1)
@@ -190,7 +190,7 @@ GEM
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
     date (3.3.4)
-    devise (4.9.2)
+    devise (4.9.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0)
@@ -803,7 +803,7 @@ DEPENDENCIES
   cucumber-rails (= 2.6.1)
   cuprite (= 0.14.3)
   database_cleaner-active_record (= 2.1.0)
-  devise (= 4.9.2)
+  devise (= 4.9.4)
   devise-two-factor (= 4.1.0)
   devise_lastseenable (= 0.0.6)
   diaspora_federation-json_schema (= 1.1.0)