diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd94fe7868..23f73ab533 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🧹 Chores
 
+- [eas-cli][build-tools][local-build-plugin][worker] Bump `tar` to `7.5.19`. ([#3971](https://github.com/expo/eas-cli/pull/3971) by [@szdziedzic](https://github.com/szdziedzic))
+
 ## [20.5.1](https://github.com/expo/eas-cli/releases/tag/v20.5.1) - 2026-07-01
 
 ### 🐛 Bug fixes
diff --git a/packages/build-tools/package.json b/packages/build-tools/package.json
index 8b65f66eed..04251894de 100644
--- a/packages/build-tools/package.json
+++ b/packages/build-tools/package.json
@@ -71,7 +71,7 @@
     "resolve-from": "^5.0.0",
     "retry": "^0.13.1",
     "semver": "^7.6.2",
-    "tar": "7.5.7",
+    "tar": "7.5.19",
     "uuid": "9.0.1",
     "yaml": "^2.8.1",
     "zod": "^4.3.5"
diff --git a/packages/eas-cli/package.json b/packages/eas-cli/package.json
index 2a347594c4..775a3e9064 100644
--- a/packages/eas-cli/package.json
+++ b/packages/eas-cli/package.json
@@ -120,7 +120,7 @@
     "semver": "7.5.4",
     "set-interval-async": "3.0.3",
     "slash": "3.0.0",
-    "tar": "7.5.7",
+    "tar": "7.5.19",
     "tar-stream": "3.1.7",
     "terminal-link": "2.1.1",
     "ts-deepmerge": "6.2.0",
diff --git a/packages/local-build-plugin/package.json b/packages/local-build-plugin/package.json
index 9c252434d5..b396b11e2f 100644
--- a/packages/local-build-plugin/package.json
+++ b/packages/local-build-plugin/package.json
@@ -39,7 +39,7 @@
     "lodash": "^4.17.21",
     "nullthrows": "^1.1.1",
     "semver": "^7.6.2",
-    "tar": "7.5.7",
+    "tar": "7.5.19",
     "uuid": "^9.0.1"
   },
   "devDependencies": {
diff --git a/packages/worker/package.json b/packages/worker/package.json
index 124424d545..5146b7c2c7 100644
--- a/packages/worker/package.json
+++ b/packages/worker/package.json
@@ -45,7 +45,7 @@
     "node-os-utils": "1.3.7",
     "nullthrows": "1.1.1",
     "semver": "7.6.3",
-    "tar": "7.5.7",
+    "tar": "7.5.19",
     "uuid": "3.4.0",
     "uuidv7": "1.1.0",
     "ws": "8.18.0",
diff --git a/yarn.lock b/yarn.lock
index 1324fbf043..341bb14a2b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2913,7 +2913,7 @@ __metadata:
     retry: "npm:^0.13.1"
     rimraf: "npm:3.0.2"
     semver: "npm:^7.6.2"
-    tar: "npm:7.5.7"
+    tar: "npm:7.5.19"
     ts-jest: "npm:^29.1.4"
     ts-mockito: "npm:^2.6.1"
     tslib: "npm:^2.6.3"
@@ -3602,7 +3602,7 @@ __metadata:
     rimraf: "npm:3.0.2"
     semver: "npm:7.6.3"
     supertest: "npm:7.2.2"
-    tar: "npm:7.5.7"
+    tar: "npm:7.5.19"
     ts-jest: "npm:29.1.4"
     typescript: "npm:5.5.4"
     uuid: "npm:3.4.0"
@@ -11121,7 +11121,7 @@ __metadata:
     nullthrows: "npm:^1.1.1"
     rimraf: "npm:3.0.2"
     semver: "npm:^7.6.2"
-    tar: "npm:7.5.7"
+    tar: "npm:7.5.19"
     ts-jest: "npm:^29.1.4"
     typescript: "npm:^5.5.4"
     uuid: "npm:^9.0.1"
@@ -11264,7 +11264,7 @@ __metadata:
     semver: "npm:7.5.4"
     set-interval-async: "npm:3.0.3"
     slash: "npm:3.0.0"
-    tar: "npm:7.5.7"
+    tar: "npm:7.5.19"
     tar-stream: "npm:3.1.7"
     terminal-link: "npm:2.1.1"
     ts-deepmerge: "npm:6.2.0"
@@ -19838,55 +19838,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:7.5.7":
-  version: 7.5.7
-  resolution: "tar@npm:7.5.7"
+"tar@npm:7.5.19, tar@npm:^7.4.3, tar@npm:^7.5.2, tar@npm:^7.5.4":
+  version: 7.5.19
+  resolution: "tar@npm:7.5.19"
   dependencies:
     "@isaacs/fs-minipass": "npm:^4.0.0"
     chownr: "npm:^3.0.0"
     minipass: "npm:^7.1.2"
     minizlib: "npm:^3.1.0"
     yallist: "npm:^5.0.0"
-  checksum: 10c0/51f261afc437e1112c3e7919478d6176ea83f7f7727864d8c2cce10f0b03a631d1911644a567348c3063c45abdae39718ba97abb073d22aa3538b9a53ae1e31c
-  languageName: node
-  linkType: hard
-
-"tar@npm:^7.4.3":
-  version: 7.5.2
-  resolution: "tar@npm:7.5.2"
-  dependencies:
-    "@isaacs/fs-minipass": "npm:^4.0.0"
-    chownr: "npm:^3.0.0"
-    minipass: "npm:^7.1.2"
-    minizlib: "npm:^3.1.0"
-    yallist: "npm:^5.0.0"
-  checksum: 10c0/a7d8b801139b52f93a7e34830db0de54c5aa45487c7cb551f6f3d44a112c67f1cb8ffdae856b05fd4f17b1749911f1c26f1e3a23bbe0279e17fd96077f13f467
-  languageName: node
-  linkType: hard
-
-"tar@npm:^7.5.2":
-  version: 7.5.6
-  resolution: "tar@npm:7.5.6"
-  dependencies:
-    "@isaacs/fs-minipass": "npm:^4.0.0"
-    chownr: "npm:^3.0.0"
-    minipass: "npm:^7.1.2"
-    minizlib: "npm:^3.1.0"
-    yallist: "npm:^5.0.0"
-  checksum: 10c0/08af3807035957650ad5f2a300c49ca4fe0566ac0ea5a23741a5b5103c6da42891a9eeaed39bc1fbcf21c5cac4dc846828a004727fb08b9d946322d3144d1fd2
-  languageName: node
-  linkType: hard
-
-"tar@npm:^7.5.4":
-  version: 7.5.9
-  resolution: "tar@npm:7.5.9"
-  dependencies:
-    "@isaacs/fs-minipass": "npm:^4.0.0"
-    chownr: "npm:^3.0.0"
-    minipass: "npm:^7.1.2"
-    minizlib: "npm:^3.1.0"
-    yallist: "npm:^5.0.0"
-  checksum: 10c0/e870beb1b2477135ca2abe86b2d18f7b35d0a4e3a37bbc523d3b8f7adca268dfab543f26528a431d569897f8c53a7cac745cdfbc4411c2f89aeeacc652b81b0a
+  checksum: 10c0/7022e8cb04a8ceccc0689f2c731743fa2aab2e3c3f559f7dbc37b65ef7d5913049b427284eded2ec0765c5db5ff72dd7939fe2ae15785ff422cef2116c95d798
   languageName: node
   linkType: hard