diff --git a/MODULE.bazel b/MODULE.bazel
index 85c8b1aec13..9f22edc114d 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -23,20 +23,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.truth:truth:1.4.5",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
-    "io.netty:netty-buffer:4.1.130.Final",
-    "io.netty:netty-codec-http2:4.1.130.Final",
-    "io.netty:netty-codec-http:4.1.130.Final",
-    "io.netty:netty-codec-socks:4.1.130.Final",
-    "io.netty:netty-codec:4.1.130.Final",
-    "io.netty:netty-common:4.1.130.Final",
-    "io.netty:netty-handler-proxy:4.1.130.Final",
-    "io.netty:netty-handler:4.1.130.Final",
-    "io.netty:netty-resolver:4.1.130.Final",
-    "io.netty:netty-tcnative-boringssl-static:2.0.74.Final",
-    "io.netty:netty-tcnative-classes:2.0.74.Final",
-    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.130.Final",
-    "io.netty:netty-transport-native-unix-common:4.1.130.Final",
-    "io.netty:netty-transport:4.1.130.Final",
+    "io.netty:netty-buffer:4.1.132.Final",
+    "io.netty:netty-codec-http2:4.1.132.Final",
+    "io.netty:netty-codec-http:4.1.132.Final",
+    "io.netty:netty-codec-socks:4.1.132.Final",
+    "io.netty:netty-codec:4.1.132.Final",
+    "io.netty:netty-common:4.1.132.Final",
+    "io.netty:netty-handler-proxy:4.1.132.Final",
+    "io.netty:netty-handler:4.1.132.Final",
+    "io.netty:netty-resolver:4.1.132.Final",
+    "io.netty:netty-tcnative-boringssl-static:2.0.75.Final",
+    "io.netty:netty-tcnative-classes:2.0.75.Final",
+    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.132.Final",
+    "io.netty:netty-transport-native-unix-common:4.1.132.Final",
+    "io.netty:netty-transport:4.1.132.Final",
     "io.opencensus:opencensus-api:0.31.0",
     "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
     "io.perfmark:perfmark-api:0.27.0",
diff --git a/SECURITY.md b/SECURITY.md
index fa5b85c0e3a..e710ceaabe1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -399,7 +399,8 @@ grpc-netty version | netty-handler version | netty-tcnative-boringssl-static ver
 1.71.x-1.74.x      | 4.1.110.Final         | 2.0.70.Final
 1.75.x-1.76.x      | 4.1.124.Final         | 2.0.72.Final
 1.77.x-1.78.x      | 4.1.127.Final         | 2.0.74.Final
-1.79.x-            | 4.1.130.Final         | 2.0.74.Final
+1.79.x-1.80.x      | 4.1.130.Final         | 2.0.74.Final
+1.81.x-            | 4.1.132.Final         | 2.0.75.Final
 
 _(grpc-netty-shaded avoids issues with keeping these versions in sync.)_
 
diff --git a/alts/src/test/java/io/grpc/alts/internal/AltsProtocolNegotiatorTest.java b/alts/src/test/java/io/grpc/alts/internal/AltsProtocolNegotiatorTest.java
index 24392af75fd..d47607ed90f 100644
--- a/alts/src/test/java/io/grpc/alts/internal/AltsProtocolNegotiatorTest.java
+++ b/alts/src/test/java/io/grpc/alts/internal/AltsProtocolNegotiatorTest.java
@@ -202,8 +202,11 @@ public void operationComplete(ChannelFuture future) throws Exception {
     channel.flush();
 
     // Capture the protected data written to the wire.
-    assertEquals(1, channel.outboundMessages().size());
-    ByteBuf protectedData = channel.readOutbound();
+    assertThat(channel.outboundMessages()).isNotEmpty();
+    ByteBuf protectedData = channel.alloc().buffer();
+    while (!channel.outboundMessages().isEmpty()) {
+      protectedData.writeBytes((ByteBuf) channel.readOutbound());
+    }
     assertEquals(message.length(), writeCount.get());
 
     // Read the protected message at the server and verify it matches the original message.
@@ -327,16 +330,18 @@ public void doNotFlushEmptyBuffer() throws Exception {
     String message = "hello";
     ByteBuf in = Unpooled.copiedBuffer(message, UTF_8);
 
-    assertEquals(0, protector.flushes.get());
+    int flushes = protector.flushes.get();
     Future<?> done = channel.write(in);
     channel.flush();
+    flushes++;
     done.get(5, TimeUnit.SECONDS);
-    assertEquals(1, protector.flushes.get());
+    assertEquals(flushes, protector.flushes.get());
 
+    // Flush does not propagate
     done = channel.write(Unpooled.EMPTY_BUFFER);
     channel.flush();
     done.get(5, TimeUnit.SECONDS);
-    assertEquals(1, protector.flushes.get());
+    assertEquals(flushes, protector.flushes.get());
   }
 
   @Test
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 73c19140478..665b13badc8 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -94,17 +94,17 @@ mockito-android = "org.mockito:mockito-android:4.4.0"
 mockito-core = "org.mockito:mockito-core:4.4.0"
 # Need to decide when we require users to absorb the breaking changes in 4.2
 # checkForUpdates: netty-codec-http2:4.1.+
-netty-codec-http2 = "io.netty:netty-codec-http2:4.1.130.Final"
+netty-codec-http2 = "io.netty:netty-codec-http2:4.1.132.Final"
 # checkForUpdates: netty-handler-proxy:4.1.+
-netty-handler-proxy = "io.netty:netty-handler-proxy:4.1.130.Final"
+netty-handler-proxy = "io.netty:netty-handler-proxy:4.1.132.Final"
 # Keep the following references of tcnative version in sync whenever it's updated:
 #   SECURITY.md
-netty-tcnative = "io.netty:netty-tcnative-boringssl-static:2.0.74.Final"
-netty-tcnative-classes = "io.netty:netty-tcnative-classes:2.0.74.Final"
+netty-tcnative = "io.netty:netty-tcnative-boringssl-static:2.0.75.Final"
+netty-tcnative-classes = "io.netty:netty-tcnative-classes:2.0.75.Final"
 # checkForUpdates: netty-transport-epoll:4.1.+
-netty-transport-epoll = "io.netty:netty-transport-native-epoll:4.1.130.Final"
+netty-transport-epoll = "io.netty:netty-transport-native-epoll:4.1.132.Final"
 # checkForUpdates: netty-unix-common:4.1.+
-netty-unix-common = "io.netty:netty-transport-native-unix-common:4.1.130.Final"
+netty-unix-common = "io.netty:netty-transport-native-unix-common:4.1.132.Final"
 okhttp = "com.squareup.okhttp:okhttp:2.7.5"
 # okio 3.5+ uses Kotlin 1.9+ which requires Android Gradle Plugin 9+
 # checkForUpdates: okio:3.4.+
diff --git a/repositories.bzl b/repositories.bzl
index de0729c35ab..811e580a4d3 100644
--- a/repositories.bzl
+++ b/repositories.bzl
@@ -27,20 +27,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.truth:truth:1.4.5",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
-    "io.netty:netty-buffer:4.1.130.Final",
-    "io.netty:netty-codec-http2:4.1.130.Final",
-    "io.netty:netty-codec-http:4.1.130.Final",
-    "io.netty:netty-codec-socks:4.1.130.Final",
-    "io.netty:netty-codec:4.1.130.Final",
-    "io.netty:netty-common:4.1.130.Final",
-    "io.netty:netty-handler-proxy:4.1.130.Final",
-    "io.netty:netty-handler:4.1.130.Final",
-    "io.netty:netty-resolver:4.1.130.Final",
-    "io.netty:netty-tcnative-boringssl-static:2.0.74.Final",
-    "io.netty:netty-tcnative-classes:2.0.74.Final",
-    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.130.Final",
-    "io.netty:netty-transport-native-unix-common:4.1.130.Final",
-    "io.netty:netty-transport:4.1.130.Final",
+    "io.netty:netty-buffer:4.1.132.Final",
+    "io.netty:netty-codec-http2:4.1.132.Final",
+    "io.netty:netty-codec-http:4.1.132.Final",
+    "io.netty:netty-codec-socks:4.1.132.Final",
+    "io.netty:netty-codec:4.1.132.Final",
+    "io.netty:netty-common:4.1.132.Final",
+    "io.netty:netty-handler-proxy:4.1.132.Final",
+    "io.netty:netty-handler:4.1.132.Final",
+    "io.netty:netty-resolver:4.1.132.Final",
+    "io.netty:netty-tcnative-boringssl-static:2.0.75.Final",
+    "io.netty:netty-tcnative-classes:2.0.75.Final",
+    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.132.Final",
+    "io.netty:netty-transport-native-unix-common:4.1.132.Final",
+    "io.netty:netty-transport:4.1.132.Final",
     "io.opencensus:opencensus-api:0.31.0",
     "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
     "io.perfmark:perfmark-api:0.27.0",