diff --git a/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch b/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch
new file mode 100644
index 00000000000..d7ee2e285e8
--- /dev/null
+++ b/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch
@@ -0,0 +1,10 @@
+diff --git a/methods/inflater.js b/methods/inflater.js
+index 8769e66e82b25541aba80b1ac6429199c9a8179f..1d4402402f0e1aaf64062c1f004c3d6e6fe93e76 100644
+--- a/methods/inflater.js
++++ b/methods/inflater.js
+@@ -1,4 +1,4 @@
+-const version = +(process.versions ? process.versions.node : "").split(".")[0] || 0;
++const version = +(process?.versions?.node ?? "").split(".")[0] || 0;
+ 
+ module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
+     var zlib = require("zlib");
diff --git a/packages/loot-core/package.json b/packages/loot-core/package.json
index 541da895529..2b4044ee80b 100644
--- a/packages/loot-core/package.json
+++ b/packages/loot-core/package.json
@@ -23,7 +23,7 @@
     "@rschedule/json-tools": "^1.5.0",
     "@rschedule/standard-date-adapter": "^1.5.0",
     "absurd-sql": "0.0.54",
-    "adm-zip": "0.5.10",
+    "adm-zip": "patch:adm-zip@npm%3A0.5.16#~/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch",
     "better-sqlite3": "^11.9.1",
     "csv-parse": "^4.16.3",
     "csv-stringify": "^5.6.5",
diff --git a/upcoming-release-notes/5019.md b/upcoming-release-notes/5019.md
new file mode 100644
index 00000000000..217ded4b664
--- /dev/null
+++ b/upcoming-release-notes/5019.md
@@ -0,0 +1,6 @@
+---
+category: Maintenance
+authors: [matt-fidd]
+---
+
+Bump adm-zip to 0.5.16
diff --git a/yarn.lock b/yarn.lock
index 393076d5393..80f46c8c5dd 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6858,10 +6858,17 @@ __metadata:
   languageName: unknown
   linkType: soft
 
-"adm-zip@npm:0.5.10":
-  version: 0.5.10
-  resolution: "adm-zip@npm:0.5.10"
-  checksum: 10/c5ab79b77114d8277f0cbfd6cca830198d6c7ee4971f6960f48e08cd2375953b11dc71729b7f396abd51d2d6cce8c862fad185ea90cb2c84ab5161c37ed1b099
+"adm-zip@npm:0.5.16":
+  version: 0.5.16
+  resolution: "adm-zip@npm:0.5.16"
+  checksum: 10/e167d1b9e60cde37334efda828fa514680af9facbd4183952f36526390e5c7da9a90ca1e6880dfd3aba7b3517f1506c6178e0dc29cd630b26b98c795f97fc599
+  languageName: node
+  linkType: hard
+
+"adm-zip@patch:adm-zip@npm%3A0.5.16#~/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch":
+  version: 0.5.16
+  resolution: "adm-zip@patch:adm-zip@npm%3A0.5.16#~/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch::version=0.5.16&hash=f6b7d0"
+  checksum: 10/1a8c866a6ad1b6b6870d39468f26369cc6a43027678708cd9d40ff64274bb45b946f570293d0ac5d23a4a2b360e36168f14a3f9bc1a1cea20b8dce7ec8d8425e
   languageName: node
   linkType: hard
 
@@ -13513,7 +13520,7 @@ __metadata:
     "@types/webpack": "npm:^5.28.5"
     "@types/webpack-bundle-analyzer": "npm:^4.6.4"
     absurd-sql: "npm:0.0.54"
-    adm-zip: "npm:0.5.10"
+    adm-zip: "patch:adm-zip@npm%3A0.5.16#~/.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch"
     assert: "npm:^2.1.0"
     better-sqlite3: "npm:^11.9.1"
     browserify-zlib: "npm:^0.2.0"