diff --git a/ChangeLog.md b/ChangeLog.md
index 57354faa5..380c91855 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -6,6 +6,7 @@
 
 General:
 
+- Updated lockfile-resolved `mysql2` from 3.24.3 to 3.24.4 for upstream patch fixes; no Azurite code changes were required.
 - Fixed `--oauth` without a value crashing during startup and unsupported OAuth levels being silently ignored. Azurite now reports the supported OAuth levels across all command-line entrypoints while treating the VS Code extension's empty default as unconfigured. (issue #2525)
 - Updated `actions/checkout` from 4.4.0 to 7.0.1 and `actions/setup-node` from 4.4.0 to 7.0.0 so the CI workflows use the actions' Node.js 24 runtimes (workflow `node-version` settings are unchanged).
 - Fixed SharedKey/SharedKeyLite authentication failing when both `date` and `x-ms-date` request headers are present. Blob and Queue now sign an empty `Date` field and Table signs the `x-ms-date` value, matching Azure Storage. (issue #1385)
diff --git a/package-lock.json b/package-lock.json
index 14fc213b1..da110bb29 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8477,9 +8477,9 @@
       "license": "ISC"
     },
     "node_modules/mysql2": {
-      "version": "3.24.3",
-      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.24.3.tgz",
-      "integrity": "sha512-OKfWHkMAg9v06neq8FmSyhbxPQKABN9PAW5G9/bDTXzJBO5xXtkKL0V27vju7HQWk9UD4Od5BZsvCtBTB1CPEw==",
+      "version": "3.24.4",
+      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.24.4.tgz",
+      "integrity": "sha512-A2olluVlj0mvgyIRRISMEzXc51m+21mRtcMVjJyIpt2GG98+XrC9m9HzsqcMsX2LcnfccJvY5NB22g8fENBnOA==",
       "license": "MIT",
       "dependencies": {
         "aws-ssl-profiles": "^1.1.2",