diff --git a/boms/cloud-lts-bom/pom.xml b/boms/cloud-lts-bom/pom.xml
index 90b4a4cf15..b9500c9478 100644
--- a/boms/cloud-lts-bom/pom.xml
+++ b/boms/cloud-lts-bom/pom.xml
@@ -51,7 +51,7 @@
     <!-- JRE for Java 8. Beam's dependency (gcsio) uses JRE flavor -->
     <guava.version>30.1.1-jre</guava.version>
     <google.autovalue.version>1.8.1</google.autovalue.version>
-    <protobuf.version>3.16.0</protobuf.version>
+    <protobuf.version>3.16.3</protobuf.version>
     <http.version>1.39.2-sp.1</http.version>
     <io.grpc.version>1.36.2</io.grpc.version>
     <!-- We don't use gax-bom because it includes the artifacts with 'testlib' classifier.