diff --git a/buck2.yaml b/buck2.yaml
index e6a3e8d29e3..a4b68a25b06 100644
--- a/buck2.yaml
+++ b/buck2.yaml
@@ -1,7 +1,7 @@
 package:
   name: buck2
   version: 20250401
-  epoch: 3 # GHSA-qx2v-8332-m4fv
+  epoch: 4 # GHSA-xwfj-jgwm-7wp5
   description: "Build system, successor to Buck"
   copyright:
     - license: MIT
@@ -38,6 +38,8 @@ pipeline:
       # read upstream's rust-toolchain file to install the right one
       rustup install
 
+  - uses: rust/cargobump
+
   - name: Configure and build
     runs: |
       # Include our nightly Rust bin/ directory in PATH
diff --git a/buck2/cargobump-deps.yaml b/buck2/cargobump-deps.yaml
new file mode 100644
index 00000000000..584f634ea45
--- /dev/null
+++ b/buck2/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+  - name: tracing-subscriber
+    version: 0.3.20