diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 32b3bfc4b83..ea33a13dc36 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.17.22"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.17.24"; # N.B: if you change this, change botocore and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Thd8ndSsRdnkGGfPt0f0yYXWsF/xRjesWGGmDaqVx8E=";
+    sha256 = "sha256-v0oyHafb4MWiA4D/n2qKTi4TXnKkA0iJASKhlzaLRCE=";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 29f00d87ad3..3f7fb23822d 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.20.22"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.20.24"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MuhvnRhVW9O03GlKJjmhwfyMi0KknaVDuVrJ0ExAdws=";
+    sha256 = "sha256-k5i82UkUQqpVmnwRG5YAS7Bq9hLlO6pxZbCmRrtDU00=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index ce3dbcc74be..1e962e5ee9a 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -28,11 +28,11 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.19.22"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.19.24"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yu2IltNbOLB44M+0u5lTjHHllDndBHp4rNfMwFOKMgw=";
+    sha256 = "sha256-eB81VdFB09QuagANaZxQuOe8N0AnqgL4aIu5HDrYg2I=";
   };
 
   # https://github.com/aws/aws-cli/issues/4837