diff --git a/docs/changelog/93755.yaml b/docs/changelog/93755.yaml
new file mode 100644
index 000000000000..03a63bc18e69
--- /dev/null
+++ b/docs/changelog/93755.yaml
@@ -0,0 +1,5 @@
+pr: 93755
+summary: Ingest-attachment module tika dependency versions
+area: Ingest Node
+type: bug
+issues: []
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index b2683949fb79..fdec6cfd8ef5 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -1573,9 +1573,9 @@
             <sha256 value="5ba0a81f4b0769122b6045b98bb9bbba5f2c69dbf736a6cc7ca4eb603c337487" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.commons" name="commons-collections4" version="4.1">
-         <artifact name="commons-collections4-4.1.jar">
-            <sha256 value="b1fe8b5968b57d8465425357ed2d9dc695504518bed2df5b565c4b8e68c1c8a5" origin="Generated by Gradle"/>
+      <component group="org.apache.commons" name="commons-collections4" version="4.4">
+         <artifact name="commons-collections4-4.4.jar">
+            <sha256 value="1df8b9430b5c8ed143d7815e403e33ef5371b2400aadbe9bda0883762e0846d1" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.apache.commons" name="commons-compress" version="1.19">
@@ -1588,6 +1588,11 @@
             <sha256 value="6aecfd5459728a595601cfa07258d131972ffc39b492eb48bdd596577a2f244a" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.apache.commons" name="commons-compress" version="1.22">
+         <artifact name="commons-compress-1.22.jar">
+            <sha256 value="53d04a0efc7223baecaa303bd5d298eb0600e6b82b4076f9cecd558b97ba760b" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.apache.commons" name="commons-compress" version="1.4.1">
          <artifact name="commons-compress-1.4.1.jar">
             <sha256 value="28a00d80716f073d644b9da76e94b5e8ff94de8e9323f06f558fba653fcf5f86" origin="Generated by Gradle"/>
@@ -1613,6 +1618,11 @@
             <sha256 value="4ee380259c068d1dbe9e84ab52186f2acd65de067ec09beff731fca1697fdb16" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.apache.commons" name="commons-lang3" version="3.12.0">
+         <artifact name="commons-lang3-3.12.0.jar">
+            <sha256 value="d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.apache.commons" name="commons-lang3" version="3.7">
          <artifact name="commons-lang3-3.7.jar">
             <sha256 value="6e8dc31e046508d9953c96534edf0c2e0bfe6f468966b5b842b3f87e43b6a847" origin="Generated by Gradle"/>
@@ -2536,24 +2546,24 @@
             <sha256 value="a25ad2a0be6b0bf9eb0e972abd09c34c0e797a3ce2a980d5ff035ff4cf078037" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.poi" name="poi" version="5.2.2">
-         <artifact name="poi-5.2.2.jar">
-            <sha256 value="eeef0dd476b1748d66defa98dcb6abbf0a049b48889af80b985ba713ac7d9409" origin="Generated by Gradle"/>
+      <component group="org.apache.poi" name="poi" version="5.2.3">
+         <artifact name="poi-5.2.3.jar">
+            <sha256 value="1d4c81a283e127693db89e85df45119d9d312d5686d2439b5be9445c2c649155" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.poi" name="poi-ooxml" version="5.2.2">
-         <artifact name="poi-ooxml-5.2.2.jar">
-            <sha256 value="07104ec94ca97f342d66aec59346f9651ee8c8b896710b6add72c85e91c0b8d1" origin="Generated by Gradle"/>
+      <component group="org.apache.poi" name="poi-ooxml" version="5.2.3">
+         <artifact name="poi-ooxml-5.2.3.jar">
+            <sha256 value="9b8ff6ecf562836299ce15997796e3d47fe063a5956c1c7d3f6e2a4bf6e60b79" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.poi" name="poi-ooxml-lite" version="5.2.2">
-         <artifact name="poi-ooxml-lite-5.2.2.jar">
-            <sha256 value="77fb2b66efb4ad324095642b67147c655234a9d134bd73dcda357f82c3b88f13" origin="Generated by Gradle"/>
+      <component group="org.apache.poi" name="poi-ooxml-lite" version="5.2.3">
+         <artifact name="poi-ooxml-lite-5.2.3.jar">
+            <sha256 value="35a200a9bd110b176450179170887bb9eac2dcba47a09d93c91e83afe70b7147" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.poi" name="poi-scratchpad" version="5.2.2">
-         <artifact name="poi-scratchpad-5.2.2.jar">
-            <sha256 value="20c0318d1c3ac3ea45ad58b05e97db3581504fbaf493c77d30718d914a072c69" origin="Generated by Gradle"/>
+      <component group="org.apache.poi" name="poi-scratchpad" version="5.2.3">
+         <artifact name="poi-scratchpad-5.2.3.jar">
+            <sha256 value="f0a98ad2a2a8c2863135357224fe8ffb2b4e7bb121d75aff59750eb671451aed" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.apache.rat" name="apache-rat" version="0.11">
@@ -2636,9 +2646,9 @@
             <sha256 value="84a81033ab310540176d480d15f7409d42d33453e474f7a2feaa906a4431cea2" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.xmlbeans" name="xmlbeans" version="5.0.3">
-         <artifact name="xmlbeans-5.0.3.jar">
-            <sha256 value="b662cba69fe211084c603ecd5733d93d4f97d64c5e273b9c7fdd521122f63fe9" origin="Generated by Gradle"/>
+      <component group="org.apache.xmlbeans" name="xmlbeans" version="5.1.1">
+         <artifact name="xmlbeans-5.1.1.jar">
+            <sha256 value="5f484a78bed71cbffe3709678b6bdd3463781a7c61c6d9872330aecbf150762a" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.apache.yetus" name="audience-annotations" version="0.5.0">
@@ -3484,6 +3494,11 @@
             <sha256 value="fe30825245d2336c859dc38d60c0fc5f3668dbf29cd586828d2b5667ec355b91" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.slf4j" name="slf4j-api" version="2.0.3">
+         <artifact name="slf4j-api-2.0.3.jar">
+            <sha256 value="68ddcda65300ff8097ad1a096d7cd2fb06cef25193887cec3f2690e01bdbf421" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.slf4j" name="slf4j-log4j12" version="1.7.10">
          <artifact name="slf4j-log4j12-1.7.10.jar">
             <sha256 value="2e4eebc6e346c92c417aa4e662738802645ef21c5eb4435132dc78d631f2eebb" origin="Generated by Gradle"/>
@@ -3539,6 +3554,11 @@
             <sha256 value="8c7964b36fe3f0cbe644b04fcbff84e491ce81917db2f5bfa0cba8e9548aff5d" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.tukaani" name="xz" version="1.9">
+         <artifact name="xz-1.9.jar">
+            <sha256 value="211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.vafer" name="jdeb" version="1.8">
          <artifact name="jdeb-1.8.jar">
             <sha256 value="374fe02a09314da6ec8219e005598e760323a1abe4b715cc33ce3e2a9bcda932" origin="Generated by Gradle"/>
diff --git a/modules/ingest-attachment/build.gradle b/modules/ingest-attachment/build.gradle
index 36dfd027cd81..542e9cd3986e 100644
--- a/modules/ingest-attachment/build.gradle
+++ b/modules/ingest-attachment/build.gradle
@@ -15,14 +15,20 @@ esplugin {
   classname 'org.elasticsearch.ingest.attachment.IngestAttachmentPlugin'
 }
 
-versions << [
+// this overwrites the 'versions' map from Elasticsearch itself, but indeed we want that -- we're interested in managing our dependencies
+// as we (and tika) demand, and are not interested in, say, having the same version of commons-codec as elasticsearch itself
+def versions = [
   'tika'  : '2.6.0',
   'pdfbox': '2.0.27',
-  'poi'   : '5.2.2',
+  'poi'   : '5.2.3',
   'mime4j': '0.8.5'
 ]
 
 dependencies {
+  // logging
+  api "org.slf4j:slf4j-api:2.0.3"
+  api "commons-logging:commons-logging:1.2"
+
   // mandatory for tika
   api "org.apache.tika:tika-core:${versions.tika}"
   api "org.apache.tika:tika-langdetect:${versions.tika}"
@@ -36,9 +42,8 @@ dependencies {
   api "org.apache.tika:tika-parser-apple-module:${versions.tika}"
   api "org.apache.tika:tika-parser-xmp-commons:${versions.tika}"
   api "org.apache.tika:tika-parser-zip-commons:${versions.tika}"
-  api 'org.tukaani:xz:1.8'
+  api 'org.tukaani:xz:1.9'
   api 'commons-io:commons-io:2.11.0'
-  api "org.slf4j:slf4j-api:${versions.slf4j}"
 
   // character set detection
   api 'com.googlecode.juniversalchardet:juniversalchardet:1.0.3'
@@ -50,23 +55,22 @@ dependencies {
   api "org.apache.pdfbox:pdfbox:${versions.pdfbox}"
   api "org.apache.pdfbox:fontbox:${versions.pdfbox}"
   api "org.apache.pdfbox:jempbox:1.8.17"
-  api "commons-logging:commons-logging:${versions.commonslogging}"
   // OpenOffice
   api "org.apache.poi:poi-ooxml:${versions.poi}"
   api "org.apache.poi:poi-ooxml-lite:${versions.poi}"
   api "org.apache.poi:poi:${versions.poi}"
-  api "commons-codec:commons-codec:${versions.commonscodec}"
-  api 'org.apache.xmlbeans:xmlbeans:5.0.3'
-  api 'org.apache.commons:commons-collections4:4.1'
+  api "commons-codec:commons-codec:1.15"
+  api 'org.apache.xmlbeans:xmlbeans:5.1.1'
+  api 'org.apache.commons:commons-collections4:4.4'
   // MS Office
   api "org.apache.poi:poi-scratchpad:${versions.poi}"
   // Apple iWork
-  api 'org.apache.commons:commons-compress:1.21'
+  api 'org.apache.commons:commons-compress:1.22'
   // Outlook documents
   api "org.apache.james:apache-mime4j-core:${versions.mime4j}"
   api "org.apache.james:apache-mime4j-dom:${versions.mime4j}"
   // EPUB books
-  api "org.apache.commons:commons-lang3:${versions.commons_lang3}"
+  api "org.apache.commons:commons-lang3:3.12.0"
   // Microsoft Word files with visio diagrams
   api 'org.apache.commons:commons-math3:3.6.1'
   // POIs dependency