diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
index 6eace0a32db7..0a9795c0ed20 100644
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -64,24 +64,25 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.23.5"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.23.11"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-uDKiTw1UCcbfitoJzSPzVT1qM4Gm4bQaryRz7VTeEzg=";
+    hash = "sha256-ID0hQiR0qOTJMOvRAgEJLheblkY77yIgu1Ofa/6r7nk=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail 'flit_core>=3.7.1,<3.9.1' 'flit_core>=3.7.1' \
-      --replace-fail 'awscrt==0.23.4' 'awscrt>=0.23.4' \
+      --replace-fail 'awscrt==0.23.8' 'awscrt>=0.23.6' \
       --replace-fail 'cryptography>=40.0.0,<43.0.2' 'cryptography>=43.0.0' \
       --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \
       --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \
-      --replace-fail 'prompt-toolkit>=3.0.24,<3.0.39' 'prompt-toolkit>=3.0.24'
+      --replace-fail 'prompt-toolkit>=3.0.24,<3.0.39' 'prompt-toolkit>=3.0.24' \
+      --replace-fail 'zipp<3.21.0' 'zipp>=3.21.0'
 
     substituteInPlace requirements-base.txt \
       --replace-fail "wheel==0.43.0" "wheel>=0.43.0"