diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 00d4c58a88ab..31a998b49a2b 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -60,6 +60,10 @@
 
   See the [upstream changelog](https://github.com/sharkdp/hyperfine/blob/v2.0.0/CHANGELOG.md#v200) for details.
 
+- `atlantis` has been updated to v0.49.0 which includes a number of breaking
+    changes to address security vulnerabilities. A fully list is available in
+    the [v0.49.0 release page](https://github.com/runatlantis/atlantis/releases/tag/v0.49.0)
+
 - `yeswiki` has been updated from 4.4.2 to 4.6.7 and now requires PHP 8.3 or newer.
   The release also removes legacy JSONP endpoints and changes several security-sensitive operations from GET to POST with CSRF tokens.
   Review the upstream [4.6.7 release notes](https://github.com/YesWiki/yeswiki/releases/tag/v4.6.7) before upgrading custom themes or integrations.
diff --git a/pkgs/by-name/at/atlantis/package.nix b/pkgs/by-name/at/atlantis/package.nix
index 4bae80f6a394..4b9f0e90e7d2 100644
--- a/pkgs/by-name/at/atlantis/package.nix
+++ b/pkgs/by-name/at/atlantis/package.nix
@@ -8,13 +8,13 @@
 
 buildGo127Module (finalAttrs: {
   pname = "atlantis";
-  version = "0.48.2";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iA5khLkukcBwrpHA7U3tZGN3l6c+fow9j0uzbR2I49A=";
+    hash = "sha256-l4YDmZfk3kgCpucK+ojWWv4oCLJaM4HR0FbSDacYVBE=";
   };
 
   ldflags = [
@@ -22,7 +22,7 @@ buildGo127Module (finalAttrs: {
     "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
-  vendorHash = "sha256-PRqmqqXbrk93bbWGKYfGbDSDn4pxKjintrPs77Re2Uo=";
+  vendorHash = "sha256-nGMmlh9DonccAIRmDZ6hdGdoAJWqxQKRtPtlyRkG58o=";
 
   subPackages = [ "." ];