diff --git a/buildSrc/version.properties b/buildSrc/version.properties
index 6f1244cdece..ba919e6003e 100644
--- a/buildSrc/version.properties
+++ b/buildSrc/version.properties
@@ -23,6 +23,12 @@ jna               = 4.5.1
 netty             = 4.1.32.Final
 joda              = 2.10.1
 
+# when updating this version, you need to ensure compatibility with:
+#  - plugins/ingest-attachment (transitive dependency, check the upstream POM)
+#  - distribution/tools/plugin-cli
+#  - x-pack/plugin/security
+bouncycastle      = 1.61
+
 # test dependencies
 randomizedrunner  = 2.7.1
 junit             = 4.12
diff --git a/distribution/tools/plugin-cli/build.gradle b/distribution/tools/plugin-cli/build.gradle
index 34544d724f4..b5acb105407 100644
--- a/distribution/tools/plugin-cli/build.gradle
+++ b/distribution/tools/plugin-cli/build.gradle
@@ -24,8 +24,8 @@ archivesBaseName = 'elasticsearch-plugin-cli'
 dependencies {
   compileOnly "org.elasticsearch:elasticsearch:${version}"
   compileOnly "org.elasticsearch:elasticsearch-cli:${version}"
-  compile "org.bouncycastle:bcpg-jdk15on:1.59"
-  compile "org.bouncycastle:bcprov-jdk15on:1.59"
+  compile "org.bouncycastle:bcpg-jdk15on:${versions.bouncycastle}"
+  compile "org.bouncycastle:bcprov-jdk15on:${versions.bouncycastle}"
   testCompile "org.elasticsearch.test:framework:${version}"
   testCompile 'com.google.jimfs:jimfs:1.1'
   testCompile 'com.google.guava:guava:18.0'
diff --git a/distribution/tools/plugin-cli/licenses/bcpg-jdk15on-1.59.jar.sha1 b/distribution/tools/plugin-cli/licenses/bcpg-jdk15on-1.59.jar.sha1
deleted file mode 100644
index 0c0be50c906..00000000000
--- a/distribution/tools/plugin-cli/licenses/bcpg-jdk15on-1.59.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-ee93e5376bb6cf0a15c027b5f5e4393f2738e709
\ No newline at end of file
diff --git a/distribution/tools/plugin-cli/licenses/bcpg-jdk15on-1.61.jar.sha1 b/distribution/tools/plugin-cli/licenses/bcpg-jdk15on-1.61.jar.sha1
new file mode 100644
index 00000000000..e7c20268ef5
--- /dev/null
+++ b/distribution/tools/plugin-cli/licenses/bcpg-jdk15on-1.61.jar.sha1
@@ -0,0 +1 @@
+422656435514ab8a28752b117d5d2646660a0ace
\ No newline at end of file
diff --git a/distribution/tools/plugin-cli/licenses/bcprov-jdk15on-1.59.jar.sha1 b/distribution/tools/plugin-cli/licenses/bcprov-jdk15on-1.59.jar.sha1
deleted file mode 100644
index aa42dbb8f69..00000000000
--- a/distribution/tools/plugin-cli/licenses/bcprov-jdk15on-1.59.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-2507204241ab450456bdb8e8c0a8f986e418bd99
\ No newline at end of file
diff --git a/distribution/tools/plugin-cli/licenses/bcprov-jdk15on-1.61.jar.sha1 b/distribution/tools/plugin-cli/licenses/bcprov-jdk15on-1.61.jar.sha1
new file mode 100644
index 00000000000..0ccfcd61a0e
--- /dev/null
+++ b/distribution/tools/plugin-cli/licenses/bcprov-jdk15on-1.61.jar.sha1
@@ -0,0 +1 @@
+00df4b474e71be02c1349c3292d98886f888d1f7
\ No newline at end of file
diff --git a/plugins/ingest-attachment/build.gradle b/plugins/ingest-attachment/build.gradle
index f75d7884db5..316bc850aec 100644
--- a/plugins/ingest-attachment/build.gradle
+++ b/plugins/ingest-attachment/build.gradle
@@ -25,7 +25,6 @@ esplugin {
 versions << [
   'tika': '1.19.1',
   'pdfbox': '2.0.12',
-  'bouncycastle': '1.59',
   'poi': '4.0.0',
   'mime4j': '0.8.2'
 ]
diff --git a/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.59.jar.sha1 b/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.59.jar.sha1
deleted file mode 100644
index dde0a237a18..00000000000
--- a/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.59.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-db389ade95f48592908a84e7050a691c8834723c
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.61.jar.sha1 b/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.61.jar.sha1
new file mode 100644
index 00000000000..a41f43da590
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.61.jar.sha1
@@ -0,0 +1 @@
+69a1ea4bead1baadd1a1e00526de050c62ea7d82
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.59.jar.sha1 b/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.59.jar.sha1
deleted file mode 100644
index be5e561ee9a..00000000000
--- a/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.59.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-9cef0aab8a4bb849a8476c058ce3ff302aba3fff
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.61.jar.sha1 b/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.61.jar.sha1
new file mode 100644
index 00000000000..7ae081447a9
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.61.jar.sha1
@@ -0,0 +1 @@
+89bb3aa5b98b48e584eee2a7401b7682a46779b4
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.59.jar.sha1 b/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.59.jar.sha1
deleted file mode 100644
index aa42dbb8f69..00000000000
--- a/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.59.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-2507204241ab450456bdb8e8c0a8f986e418bd99
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.61.jar.sha1 b/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.61.jar.sha1
new file mode 100644
index 00000000000..0ccfcd61a0e
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.61.jar.sha1
@@ -0,0 +1 @@
+00df4b474e71be02c1349c3292d98886f888d1f7
\ No newline at end of file
diff --git a/x-pack/plugin/security/cli/build.gradle b/x-pack/plugin/security/cli/build.gradle
index 1c684809a32..1a829704d40 100644
--- a/x-pack/plugin/security/cli/build.gradle
+++ b/x-pack/plugin/security/cli/build.gradle
@@ -8,8 +8,8 @@ dependencies {
     compileOnly "org.elasticsearch:elasticsearch:${version}"
     // "org.elasticsearch.plugin:x-pack-core:${version}" doesn't work with idea because the testArtifacts are also here
     compileOnly project(path: xpackModule('core'), configuration: 'default')
-    compile 'org.bouncycastle:bcpkix-jdk15on:1.59'
-    compile 'org.bouncycastle:bcprov-jdk15on:1.59'
+    compile "org.bouncycastle:bcpkix-jdk15on:${versions.bouncycastle}"
+    compile "org.bouncycastle:bcprov-jdk15on:${versions.bouncycastle}"
     testImplementation 'com.google.jimfs:jimfs:1.1'
     testCompile "junit:junit:${versions.junit}"
     testCompile "org.hamcrest:hamcrest-all:${versions.hamcrest}"
diff --git a/x-pack/plugin/security/cli/licenses/bcpkix-jdk15on-1.59.jar.sha1 b/x-pack/plugin/security/cli/licenses/bcpkix-jdk15on-1.59.jar.sha1
deleted file mode 100644
index be5e561ee9a..00000000000
--- a/x-pack/plugin/security/cli/licenses/bcpkix-jdk15on-1.59.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-9cef0aab8a4bb849a8476c058ce3ff302aba3fff
\ No newline at end of file
diff --git a/x-pack/plugin/security/cli/licenses/bcpkix-jdk15on-1.61.jar.sha1 b/x-pack/plugin/security/cli/licenses/bcpkix-jdk15on-1.61.jar.sha1
new file mode 100644
index 00000000000..7ae081447a9
--- /dev/null
+++ b/x-pack/plugin/security/cli/licenses/bcpkix-jdk15on-1.61.jar.sha1
@@ -0,0 +1 @@
+89bb3aa5b98b48e584eee2a7401b7682a46779b4
\ No newline at end of file
diff --git a/x-pack/plugin/security/cli/licenses/bcprov-jdk15on-1.59.jar.sha1 b/x-pack/plugin/security/cli/licenses/bcprov-jdk15on-1.59.jar.sha1
deleted file mode 100644
index aa42dbb8f69..00000000000
--- a/x-pack/plugin/security/cli/licenses/bcprov-jdk15on-1.59.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-2507204241ab450456bdb8e8c0a8f986e418bd99
\ No newline at end of file
diff --git a/x-pack/plugin/security/cli/licenses/bcprov-jdk15on-1.61.jar.sha1 b/x-pack/plugin/security/cli/licenses/bcprov-jdk15on-1.61.jar.sha1
new file mode 100644
index 00000000000..0ccfcd61a0e
--- /dev/null
+++ b/x-pack/plugin/security/cli/licenses/bcprov-jdk15on-1.61.jar.sha1
@@ -0,0 +1 @@
+00df4b474e71be02c1349c3292d98886f888d1f7
\ No newline at end of file