diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index 941862b2a3d..f8fcd864766 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.4.27";
+  version = "1.4.28";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     rev = "refs/tags/${version}";
-    hash = "sha256-iQNMU77nTv6KY9LJb1fiBUVs5LkpX732UpJAYdUWNyc=";
+    hash = "sha256-SH45I+81fqvViyiiSwYJq6v8PPcWENCh0Ey6taKI3Us=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index b48ca6fe9f6..6abd3e06c93 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,14 +22,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.3.237";
+  version = "2.3.246";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-7ugTfWv6CRj5vsrT1DvfaR39Ytct3tse+2210WBHP9g=";
+    hash = "sha256-IDyDvwpCB/rZkaAWmAvudctT3FDDCKentqJVfM/YV7s=";
   };
 
   patches = [
@@ -121,6 +121,7 @@ buildPythonApplication rec {
     "test_secret_value_in_keyword"
     "test_runner_verify_secrets_skip_invalid_suppressed"
     "test_runner_verify_secrets_skip_all_no_effect"
+    "test_runner"
   ];
 
   disabledTestPaths = [