diff --git a/build.sh b/build.sh
index 729cc57e75..67a232f6ef 100755
--- a/build.sh
+++ b/build.sh
@@ -22,9 +22,9 @@ if [ -n "${GITHUB_ACTIONS-}" ] || [ -n "${CODESPACES-}" ] ; then
     PYTHON=$(command -v python)
 else
     # Otherwise, we install it from scratch
-    # NOTE: keep this version in sync with PYMAIN in tooling
-    "$SCRIPTS/ensure-python.sh" 3.8.10
-    PYTHON=$(pythonloc 3.8.10)/bin/python
+    # NOTE: tooling keeps this version in sync with PYMAIN in tooling
+    "$SCRIPTS/ensure-python.sh" 3.8.11
+    PYTHON=$(pythonloc 3.8.11)/bin/python
 fi
 
 TOOL_REQUIREMENTS="$ROOT/requirements/tools.txt"
diff --git a/requirements/test.txt b/requirements/test.txt
index 7e9f3a761d..76d3f00b74 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -12,7 +12,7 @@ execnet==1.9.0
     # via pytest-xdist
 iniconfig==1.1.1
     # via pytest
-packaging==20.9
+packaging==21.0
     # via pytest
 pexpect==4.8.0
     # via -r requirements/test.in
diff --git a/requirements/tools.txt b/requirements/tools.txt
index 3ce6f7b445..b9f47a3c6b 100644
--- a/requirements/tools.txt
+++ b/requirements/tools.txt
@@ -10,7 +10,7 @@ appdirs==1.4.4
     # via
     #   black
     #   virtualenv
-asgiref==3.3.4
+asgiref==3.4.1
     # via django
 attrs==21.2.0
     # via
@@ -61,7 +61,7 @@ decorator==5.0.9
     #   traitlets
 distlib==0.3.2
     # via virtualenv
-django==3.2.4
+django==3.2.5
     # via -r requirements/tools.in
 docutils==0.16
     # via
@@ -107,7 +107,7 @@ idna==2.10
     # via requests
 imagesize==1.2.0
     # via sphinx
-importlib-metadata==4.5.0
+importlib-metadata==4.6.0
     # via
     #   keyring
     #   twine
@@ -147,7 +147,7 @@ mypy-extensions==0.4.3
     #   black
     #   mypy
     #   typing-inspect
-packaging==20.9
+packaging==21.0
     # via
     #   bleach
     #   pytest
@@ -213,7 +213,7 @@ pytz==2021.1
     # via
     #   babel
     #   django
-pyupgrade==2.19.4
+pyupgrade==2.20.0
     # via shed
 pyyaml==5.4.1
     # via
@@ -221,7 +221,7 @@ pyyaml==5.4.1
     #   libcst
 readme-renderer==29.0
     # via twine
-regex==2021.4.4
+regex==2021.7.1
     # via black
 requests==2.25.1
     # via
@@ -302,13 +302,13 @@ traitlets==4.3.3
     #   ipython
 twine==3.4.1
     # via -r requirements/tools.in
-types-click==7.1.1
+types-click==7.1.2
     # via -r requirements/tools.in
-types-pkg-resources==0.1.2
+types-pkg-resources==0.1.3
     # via -r requirements/tools.in
-types-pytz==0.1.1
+types-pytz==2021.1.0
     # via -r requirements/tools.in
-types-redis==3.5.1
+types-redis==3.5.4
     # via -r requirements/tools.in
 typing-extensions==3.10.0.0
     # via
@@ -327,7 +327,7 @@ webencodings==0.5.1
     # via bleach
 wheel==0.36.2
     # via pip-tools
-zipp==3.4.1
+zipp==3.5.0
     # via importlib-metadata
 
 # The following packages are considered to be unsafe in a requirements file:
diff --git a/tooling/src/hypothesistooling/__main__.py b/tooling/src/hypothesistooling/__main__.py
index 39c3016680..62c49b1c7a 100644
--- a/tooling/src/hypothesistooling/__main__.py
+++ b/tooling/src/hypothesistooling/__main__.py
@@ -303,6 +303,7 @@ def update_python_versions():
     if sh_before != sh_after:
         build_sh.unlink()  # so bash doesn't reload a modified file
         build_sh.write_text(sh_after)
+        build_sh.chmod(0o755)
 
 
 @task()
@@ -359,10 +360,10 @@ def run_tox(task, version):
 
 
 # See update_python_versions() above
-PY36 = "3.6.13"
-PY37 = "3.7.10"
-PY38 = PYMAIN = "3.8.10"  # Sync PYMAIN minor version with GH Actions main.yml
-PY39 = "3.9.5"
+PY36 = "3.6.14"
+PY37 = "3.7.11"
+PY38 = PYMAIN = "3.8.11"  # Sync PYMAIN minor version with GH Actions main.yml
+PY39 = "3.9.6"
 PY310 = "3.10-dev"
 PYPY36 = "pypy3.6-7.3.3"
 PYPY37 = "pypy3.7-7.3.5"