diff --git a/WORKSPACE b/WORKSPACE
index 3f5f25b..e7c165e 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -164,17 +164,21 @@
     sha1 = "94ad16d728b374d65bd897625f3fbb3da223a2b6",
 )
 
+# When upgrading commons_compress, upgrade tukaani_xz to the
+# corresponding version
 maven_jar(
     name = "commons_compress",
     artifact = "org.apache.commons:commons-compress:1.13",
     sha1 = "15c5e9584200122924e50203ae210b57616b75ee",
 )
 
+# Transitive dependency of commons_compress. Should only be
+# upgraded at the same time as commons_compress.
 maven_jar(
     name = "tukaani_xz",
-    artifact = "org.tukaani:xz:1.6",
+    artifact = "org.tukaani:xz:1.4",
     attach_source = False,
-    sha1 = "05b6f921f1810bdf90e25471968f741f87168b64",
+    sha1 = "18a9a2ce6abf32ea1b5fd31dae5210ad93f4e5e3",
 )
 
 maven_jar(