diff --git a/pulumi-language-java.yaml b/pulumi-language-java.yaml
index 970fb00dc71..3a99b242d3b 100644
--- a/pulumi-language-java.yaml
+++ b/pulumi-language-java.yaml
@@ -1,7 +1,7 @@
 package:
   name: pulumi-language-java
   version: 0.9.3
-  epoch: 1
+  epoch: 2
   description: Pulumi Language SDK for Java
   copyright:
     - license: Apache-2.0
@@ -23,12 +23,12 @@ pipeline:
 
   - uses: go/build
     with:
+      modroot: pkg
       packages: ./cmd/pulumi-language-java
       output: pulumi-language-java
       ldflags: -s -w -X github.com/pulumi/pulumi-java/pkg/version.Version=v${{package.version}}
-      # Mitigate GHSA-hw7c-3rfg-p46j
-      deps: google.golang.org/protobuf@v1.29.1
-      modroot: pkg
+      # Mitigate GHSA-hw7c-3rfg-p46j and CVE-2023-1732
+      deps: google.golang.org/protobuf@v1.29.1 github.com/cloudflare/circl@v1.3.3
 
   - uses: strip