diff --git a/gerrit-pgm/src/main/resources/com/google/gerrit/pgm/libraries.config b/gerrit-pgm/src/main/resources/com/google/gerrit/pgm/libraries.config
index 6f80364e6a..e197bc74ce 100644
--- a/gerrit-pgm/src/main/resources/com/google/gerrit/pgm/libraries.config
+++ b/gerrit-pgm/src/main/resources/com/google/gerrit/pgm/libraries.config
@@ -15,9 +15,9 @@
 
 # Version should match lib/bouncycastle/BUCK
 [library "bouncyCastle"]
-  name = Bouncy Castle Crypto v144
-  url = http://www.bouncycastle.org/download/bcprov-jdk16-144.jar
-  sha1 = 6327a5f7a3dc45e0fd735adb5d08c5a74c05c20c
+  name = Bouncy Castle Crypto v149
+  url = http://repo1.maven.org/maven2/org/bouncycastle/bcprov-jdk15on/1.49/bcprov-jdk15on-1.49.jar
+  sha1 = f5155f04330459104b79923274db5060c1057b99
   remove = bcprov-.*[.]jar
 
 [library "mysqlDriver"]
diff --git a/lib/bouncycastle/BUCK b/lib/bouncycastle/BUCK
index 3d76ea67c1..2a1d3ba503 100644
--- a/lib/bouncycastle/BUCK
+++ b/lib/bouncycastle/BUCK
@@ -2,19 +2,19 @@ include_defs('//lib/maven.defs')
 
 # This version must match the version that also appears in
 # gerrit-pgm/src/main/resources/com/google/gerrit/pgm/libraries.config
-VERSION = '1.44'
+VERSION = '1.49'
 
 maven_jar(
   name = 'bcprov',
-  id = 'org.bouncycastle:bcprov-jdk16:' + VERSION,
-  sha1 = '6327a5f7a3dc45e0fd735adb5d08c5a74c05c20c',
+  id = 'org.bouncycastle:bcprov-jdk15on:' + VERSION,
+  sha1 = 'f5155f04330459104b79923274db5060c1057b99',
   license = 'DO_NOT_DISTRIBUTE', #'bouncycastle'
 )
 
 maven_jar(
   name = 'bcpg',
-  id = 'org.bouncycastle:bcpg-jdk16:' + VERSION,
-  sha1 = 'ee14f5a29cb3cf9c1edec034ab16e1bbd26e9647',
+  id = 'org.bouncycastle:bcpg-jdk15on:' + VERSION,
+  sha1 = '081d84be5b125e1997ab0e2244d1a2276b5de76c',
   license = 'DO_NOT_DISTRIBUTE', #'bouncycastle'
   deps = [':bcprov'],
 )