diff --git a/src/package-lock.json b/src/package-lock.json
index 811a2aaea..0a7b9210d 100644
--- a/src/package-lock.json
+++ b/src/package-lock.json
@@ -2379,9 +2379,9 @@
       "integrity": "sha512-MTjE2eIbHv5DyfuFz4zLYWxpqVhEhkTiwFGuB74Q9CSou2WHO52nlE5y3Zlg6SIsiYUIPj6ifFxnkPz6O3sIUg=="
     },
     "express-session": {
-      "version": "1.17.2",
-      "resolved": "https://registry.npmjs.org/express-session/-/express-session-1.17.2.tgz",
-      "integrity": "sha512-mPcYcLA0lvh7D4Oqr5aNJFMtBMKPLl++OKKxkHzZ0U0oDq1rpKBnkR5f5vCHR26VeArlTOEF9td4x5IjICksRQ==",
+      "version": "npm:@etherpad/express-session@1.18.1",
+      "resolved": "https://registry.npmjs.org/@etherpad/express-session/-/express-session-1.18.1.tgz",
+      "integrity": "sha512-K+dYeES5iKPib+NRJ+/tX04IfTnCUnpV/aiuifI1ecQGnrWSVMuK5MrwDD0lYC/OBYWS5ovar5E+R4/IbjXknA==",
       "requires": {
         "cookie": "0.4.1",
         "cookie-signature": "1.0.6",
diff --git a/src/package.json b/src/package.json
index 17541c37f..fc74675dc 100644
--- a/src/package.json
+++ b/src/package.json
@@ -39,7 +39,7 @@
     "etherpad-yajsml": "0.0.12",
     "express": "4.17.1",
     "express-rate-limit": "^5.5.1",
-    "express-session": "1.17.2",
+    "express-session": "npm:@etherpad/express-session@^1.18.1",
     "fast-deep-equal": "^3.1.3",
     "find-root": "1.1.0",
     "formidable": "^1.2.6",