diff --git a/History.md b/History.md
index 199f327bc0..7741ed080d 100644
--- a/History.md
+++ b/History.md
@@ -24,9 +24,9 @@ N/A
 * Node has been updated to version
   [8.16.1](https://nodejs.org/en/blog/release/v8.16.1/).
 
-* The `npm` npm package has been updated to version 6.10.2, and our
-  [fork](https://github.com/meteor/pacote/tree/v9.5.4-meteor) of its
-  `pacote` dependency has been updated to version 9.5.4.
+* The `npm` npm package has been updated to version 6.11.3, and our
+  [fork](https://github.com/meteor/pacote/tree/v9.5.8-meteor) of its
+  `pacote` dependency has been updated to version 9.5.8.
 
 * When bundling client code, the Meteor module system now prefers the
   `"module"` field in `package.json`, if defined.
diff --git a/scripts/build-dev-bundle-common.sh b/scripts/build-dev-bundle-common.sh
index 9eb483d197..c1810b44a8 100644
--- a/scripts/build-dev-bundle-common.sh
+++ b/scripts/build-dev-bundle-common.sh
@@ -8,7 +8,7 @@ ARCH=$(uname -m)
 NODE_VERSION=8.16.1
 MONGO_VERSION_64BIT=4.0.6
 MONGO_VERSION_32BIT=3.2.22
-NPM_VERSION=6.10.2
+NPM_VERSION=6.11.3
 
 # If we built Node from source on Jenkins, this is the build number.
 NODE_BUILD_NUMBER=
diff --git a/scripts/dev-bundle-tool-package.js b/scripts/dev-bundle-tool-package.js
index 06b471059a..014d312817 100644
--- a/scripts/dev-bundle-tool-package.js
+++ b/scripts/dev-bundle-tool-package.js
@@ -10,8 +10,8 @@ var packageJson = {
   dependencies: {
     // Explicit dependency because we are replacing it with a bundled version
     // and we want to make sure there are no dependencies on a higher version
-    npm: "6.10.2",
-    pacote: "https://github.com/meteor/pacote/tarball/bdd1a189f71142c9eb87c4298784e2f17746a5d7",
+    npm: "6.11.3",
+    pacote: "https://github.com/meteor/pacote/tarball/00b3b094e6074e45fc221d5bd96419d07ea34c6a",
     "node-gyp": "5.0.1",
     "node-pre-gyp": "0.13.0",
     typescript: "3.5.3",