diff --git a/pyproject.toml b/pyproject.toml
index 8faa14a86c..035d03facc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -61,6 +61,7 @@ module = [
     "disposable_email_domains.*",
     "django.*",
     "django_auth_ldap.*",
+    "django_cte.*",
     "django_otp.*",
     "django_sendfile.*",
     "django_statsd.*",
diff --git a/requirements/common.in b/requirements/common.in
index c94c0c442f..87242166e9 100644
--- a/requirements/common.in
+++ b/requirements/common.in
@@ -186,3 +186,6 @@ pymongo
 
 # Non-backtracking regular expressions
 google-re2
+
+# For querying recursive group membership
+django-cte
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 881a49c1bd..59cd28f087 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -390,6 +390,10 @@ django-bitfield==2.1.0 \
 django-bmemcached==0.3.0 \
     --hash=sha256:4e4b7d97216dbae331c1de10e699ca22804b94ec3a90d2762dd5d146e6986a8a
     # via -r requirements/common.in
+django-cte==1.1.5 \
+    --hash=sha256:32296007cfc820d55b01e2fdfcc9d7c39e0f470cf4c64ac7d321e7aadf8f9a3b \
+    --hash=sha256:eceb36657efcf9f0a10b1be0da1ca76fe37c73f015962457edb54d356d87a4b4
+    # via -r requirements/common.in
 django-formtools==2.3 \
     --hash=sha256:4699937e19ee041d803943714fe0c1c7ad4cab802600eb64bbf4cdd0a1bfe7d9 \
     --hash=sha256:9663b6eca64777b68d6d4142efad8597fe9a685924673b25aa8a1dcff4db00c3
diff --git a/requirements/prod.txt b/requirements/prod.txt
index 46507003a5..69faa3663e 100644
--- a/requirements/prod.txt
+++ b/requirements/prod.txt
@@ -244,6 +244,10 @@ django-bitfield==2.1.0 \
 django-bmemcached==0.3.0 \
     --hash=sha256:4e4b7d97216dbae331c1de10e699ca22804b94ec3a90d2762dd5d146e6986a8a
     # via -r requirements/common.in
+django-cte==1.1.5 \
+    --hash=sha256:32296007cfc820d55b01e2fdfcc9d7c39e0f470cf4c64ac7d321e7aadf8f9a3b \
+    --hash=sha256:eceb36657efcf9f0a10b1be0da1ca76fe37c73f015962457edb54d356d87a4b4
+    # via -r requirements/common.in
 django-formtools==2.3 \
     --hash=sha256:4699937e19ee041d803943714fe0c1c7ad4cab802600eb64bbf4cdd0a1bfe7d9 \
     --hash=sha256:9663b6eca64777b68d6d4142efad8597fe9a685924673b25aa8a1dcff4db00c3
diff --git a/version.py b/version.py
index cb4fd06ebb..b12b083d62 100644
--- a/version.py
+++ b/version.py
@@ -48,4 +48,4 @@ API_FEATURE_LEVEL = 105
 #   historical commits sharing the same major version, in which case a
 #   minor version bump suffices.
 
-PROVISION_VERSION = "162.1"
+PROVISION_VERSION = "162.2"