diff --git a/api/urls.py b/api/urls.py
index 1215747..fd99e3e 100644
--- a/api/urls.py
+++ b/api/urls.py
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.conf import settings
-from django.conf.urls import include, url
+from django.urls import include, path
 from rest_framework import routers
 
 from .viewsets import UserViewSet
@@ -29,6 +29,6 @@ app_name = 'api'
 # Wire up our API using automatic URL routing.
 # Additionally, we include login URLs for the browsable API.
 urlpatterns = [
-    url('^', include(router.urls)),
-    url('^api-auth/', include('rest_framework.urls', namespace='rest_framework')),
+    path('', include(router.urls)),
+    path('api-auth/', include('rest_framework.urls', namespace='rest_framework')),
 ]
diff --git a/registration/migrations/0006_alter_registration_polymorphic_ctype.py b/registration/migrations/0006_alter_registration_polymorphic_ctype.py
new file mode 100644
index 0000000..2b9ffe8
--- /dev/null
+++ b/registration/migrations/0006_alter_registration_polymorphic_ctype.py
@@ -0,0 +1,25 @@
+# Generated by Django 4.1.7 on 2023-03-22 11:22
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("contenttypes", "0002_remove_content_type_name"),
+        ("registration", "0005_studentregistration_vaccine_sheet"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="registration",
+            name="polymorphic_ctype",
+            field=models.ForeignKey(
+                editable=False,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="polymorphic_%(app_label)s.%(class)s_set+",
+                to="contenttypes.contenttype",
+            ),
+        ),
+    ]
diff --git a/requirements.txt b/requirements.txt
index 067ca8d..7bdc0ce 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,5 @@
 crispy-bootstrap5~=0.7
-Django>=3.2,<4.0
+Django>=4.1,<5.0
 django-cas-server~=2.0
 django-crispy-forms~=1.14
 django-extensions~=3.2
@@ -16,7 +16,7 @@ matrix-nio~=0.20
 phonenumbers~=8.12.57
 psycopg2-binary~=2.9.5
 pypdf~=3.4
-ipython~=8.5.0
+ipython~=8.11.0
 python-magic~=0.4.26
 requests~=2.28.1
 sympasoap~=1.1
diff --git a/tfjm/settings_prod.py b/tfjm/settings_prod.py
index c7cd466..6a0a601 100644
--- a/tfjm/settings_prod.py
+++ b/tfjm/settings_prod.py
@@ -25,7 +25,6 @@ DEFAULT_FROM_EMAIL = os.getenv('FROM_EMAIL', 'Contact TFJM²') + f" <{SERVER_EMA
 
 # Security settings
 SECURE_CONTENT_TYPE_NOSNIFF = False
-SECURE_BROWSER_XSS_FILTER = False
 SESSION_COOKIE_SECURE = False
 CSRF_COOKIE_SECURE = False
 CSRF_COOKIE_HTTPONLY = False
diff --git a/tox.ini b/tox.ini
index f64512d..cf30d7f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -12,7 +12,7 @@ sitepackages = False
 deps =
     coverage
     crispy-bootstrap5~=0.7
-    Django>=3.2,<4.0
+    Django>=4.1,<5.0
     django-crispy-forms~=1.14
     django-filter~=22.1
     django-haystack~=3.2