diff --git a/go.mod b/go.mod
index ceb3f891..7cb67792 100644
--- a/go.mod
+++ b/go.mod
@@ -18,7 +18,7 @@ require (
 	github.com/iancoleman/strcase v0.3.0
 	github.com/martinlindhe/base36 v1.1.1
 	github.com/open-policy-agent/opa v0.57.0
-	github.com/pomerium/pomerium v0.23.1-0.20231012155518-5f9f46652afc
+	github.com/pomerium/pomerium v0.23.1-0.20231024153910-1996550c541e
 	github.com/rs/zerolog v1.31.0
 	github.com/sergi/go-diff v1.3.1
 	github.com/spf13/cobra v1.7.0
diff --git a/go.sum b/go.sum
index 6c06abac..2a3b56eb 100644
--- a/go.sum
+++ b/go.sum
@@ -743,8 +743,8 @@ github.com/pomerium/csrf v1.7.0 h1:Qp4t6oyEod3svQtKfJZs589mdUTWKVf7q0PgCKYCshY=
 github.com/pomerium/csrf v1.7.0/go.mod h1:hAPZV47mEj2T9xFs+ysbum4l7SF1IdrryYaY6PdoIqw=
 github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524 h1:3YQY1sb54tEEbr0L73rjHkpLB0IB6qh3zl1+XQbMLis=
 github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524/go.mod h1:7fGbUYJnU8RcxZJvUvhukOIBv1G7LWDAHMfDxAf5+Y0=
-github.com/pomerium/pomerium v0.23.1-0.20231012155518-5f9f46652afc h1:VZ58/a+bIBunnC4csxv40CE/kmI/IaTKtlmeKh5dr7s=
-github.com/pomerium/pomerium v0.23.1-0.20231012155518-5f9f46652afc/go.mod h1:KmS5H8Ee1witcrGy8zriCrKgkmmZnExsu/+enID9GA4=
+github.com/pomerium/pomerium v0.23.1-0.20231024153910-1996550c541e h1:6rMbDv43F+tSvR12Tr+rKXs6biRREaRcGTNmJV5djVA=
+github.com/pomerium/pomerium v0.23.1-0.20231024153910-1996550c541e/go.mod h1:KmS5H8Ee1witcrGy8zriCrKgkmmZnExsu/+enID9GA4=
 github.com/pomerium/webauthn v0.0.0-20221118023040-00a9c430578b h1:oll/aOfJudnqFAwCvoXK9+WN2zVjTzHVPLXCggHQmHk=
 github.com/pomerium/webauthn v0.0.0-20221118023040-00a9c430578b/go.mod h1:KswTenBBh4y1pmhU2dpm8VgJQCgSErCg7OOFTeebrNc=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
diff --git a/scripts/get-envoy.bash b/scripts/get-envoy.bash
index 44d3015b..32a4928d 100755
--- a/scripts/get-envoy.bash
+++ b/scripts/get-envoy.bash
@@ -5,7 +5,7 @@ PATH="$PATH:$(go env GOPATH)/bin"
 export PATH
 
 _project_root="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)/.."
-_envoy_version=1.27.1
+_envoy_version=1.28.0
 _dir="$_project_root/pomerium/envoy/bin"
 _target="${TARGET:-"$(go env GOOS)-$(go env GOARCH)"}"