diff --git a/packages/http-client/RELEASES.md b/packages/http-client/RELEASES.md
index 93b4b49a74..e66015b792 100644
--- a/packages/http-client/RELEASES.md
+++ b/packages/http-client/RELEASES.md
@@ -1,5 +1,9 @@
 # Releases
 
+## 4.0.2
+
+- Bump the minimum `undici` version from `6.23.0` to `6.28.1` and refresh the lockfile to `6.29.0`.
+
 ## 4.0.1
 
 - Bump `undici` from `6.23.0` to `6.24.0` [#2347](https://github.com/actions/toolkit/pull/2347)
diff --git a/packages/http-client/package-lock.json b/packages/http-client/package-lock.json
index 52574b6c24..34e7c85f1d 100644
--- a/packages/http-client/package-lock.json
+++ b/packages/http-client/package-lock.json
@@ -1,16 +1,16 @@
 {
   "name": "@actions/http-client",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/http-client",
-      "version": "4.0.1",
+      "version": "4.0.2",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
-        "undici": "^6.23.0"
+        "undici": "^6.28.1"
       },
       "devDependencies": {
         "@types/node": "24.1.0",
@@ -232,9 +232,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.24.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.0.tgz",
-      "integrity": "sha512-lVLNosgqo5EkGqh5XUDhGfsMSoO8K0BAN0TyJLvwNRSl4xWGZlCVYsAIpa/OpA3TvmnM01GWcoKmc3ZWo5wKKA==",
+      "version": "6.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz",
+      "integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"
diff --git a/packages/http-client/package.json b/packages/http-client/package.json
index e6e89452f7..4a9e91516f 100644
--- a/packages/http-client/package.json
+++ b/packages/http-client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@actions/http-client",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Actions Http Client",
   "keywords": [
     "github",
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "tunnel": "^0.0.6",
-    "undici": "^6.23.0"
+    "undici": "^6.28.1"
   },
   "overrides": {
     "uri-js": "npm:uri-js-replace@^1.0.1"