diff --git a/CHANGELOG.md b/CHANGELOG.md
index 08c77f7c..b62e1fe8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,19 @@ JitPack continue to resolve through the existing coordinates.
   excluded by convention (`InternalAnnotationCoverageTest` covers those).
   Method-level `@since` backfill for the ~380 public methods in these
   packages is intentionally out of scope here and tracked separately.
+- **`maven-enforcer-plugin` gate** (Track E2). Binds three rules to the
+  `validate` phase so the build refuses to start when a precondition is
+  broken: `requireJavaVersion` (≥ 17 — the declared baseline, catches
+  accidental JDK 11 / 15 attempts), `requireMavenVersion` (≥ 3.8.0 —
+  the oldest version the planned central-publishing pipeline supports),
+  and `requirePluginVersions` (every plugin must declare an explicit
+  non-`LATEST` / non-`RELEASE` / non-`SNAPSHOT` version — the
+  generalisation of the PR-7.1 exec-plugin drift lesson).
+  Default-lifecycle plugins (`clean` / `install` / `site` / `resources` /
+  `deploy`) are now pinned in a new `<pluginManagement>` block so
+  `requirePluginVersions` has nothing to flag. Minimums and versions
+  live in `<properties>` (`enforcer.requireMavenVersion`,
+  `enforcer.requireJavaVersion`, `maven.enforcer.plugin.version`).
 - **Parallel-session stress test** (Track I2). New
   `DocumentSessionParallelStressTest` drives 32 independent
   `DocumentSession` instances on a fixed-size thread pool through 4
diff --git a/pom.xml b/pom.xml
index 9428937b..ab8da098 100644
--- a/pom.xml
+++ b/pom.xml
@@ -66,9 +66,14 @@
 
         <!-- Build plugins -->
         <maven.compiler.plugin.version>3.15.0</maven.compiler.plugin.version>
+        <maven.enforcer.plugin.version>3.5.0</maven.enforcer.plugin.version>
         <maven.javadoc.plugin.version>3.12.0</maven.javadoc.plugin.version>
         <maven.surefire.plugin.version>3.5.5</maven.surefire.plugin.version>
 
+        <!-- Minimum toolchain (enforced by maven-enforcer-plugin) -->
+        <enforcer.requireMavenVersion>3.8.0</enforcer.requireMavenVersion>
+        <enforcer.requireJavaVersion>17</enforcer.requireJavaVersion>
+
         <!-- Binary compatibility baseline (japicmp profile) -->
         <japicmp.version>0.23.1</japicmp.version>
         <japicmp.baseline>v1.6.5</japicmp.baseline>
@@ -262,6 +267,44 @@
     </dependencies>
 
     <build>
+        <!--
+            Pin the default-lifecycle plugins (clean / install / site /
+            resources / deploy) so requirePluginVersions in the enforcer
+            block below has nothing to flag. Versions match what Maven
+            3.9.x currently resolves out-of-the-box; the explicit pin
+            stops a future Maven upgrade from silently shifting the
+            plugin set we build against.
+        -->
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-clean-plugin</artifactId>
+                    <version>3.4.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-install-plugin</artifactId>
+                    <version>3.1.4</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-site-plugin</artifactId>
+                    <version>3.21.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-resources-plugin</artifactId>
+                    <version>3.3.1</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-deploy-plugin</artifactId>
+                    <version>3.1.4</version>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+
         <plugins>
             <!-- Kotlin compatibility / mixed-source support -->
             <plugin>
@@ -297,6 +340,54 @@
                 </configuration>
             </plugin>
 
+            <!--
+                Build-time precondition enforcement. Three rules:
+                * requireJavaVersion: blocks builds on JDK < 17 (the
+                  declared baseline). Catches "works on my Java 21,
+                  silently breaks on the JDK 17 CI matrix" drift.
+                * requireMavenVersion: blocks Maven < 3.8.0 — the
+                  oldest version that fully supports the resolver
+                  features the central-publishing plugin (Track D3)
+                  needs to ship Maven Central artefacts.
+                * requirePluginVersions: every plugin must declare an
+                  explicit <version>. Stops the inherited "latest" or
+                  reactor-default drift that broke the v1.6.0 release
+                  (cf. PR-7.1 exec-plugin lesson). Tracked as 1.6.6 E2.
+            -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <version>${maven.enforcer.plugin.version}</version>
+                <executions>
+                    <execution>
+                        <id>enforce-toolchain-and-plugin-versions</id>
+                        <phase>validate</phase>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireMavenVersion>
+                                    <version>[${enforcer.requireMavenVersion},)</version>
+                                    <message>GraphCompose requires Maven ${enforcer.requireMavenVersion} or newer.</message>
+                                </requireMavenVersion>
+                                <requireJavaVersion>
+                                    <version>[${enforcer.requireJavaVersion},)</version>
+                                    <message>GraphCompose requires JDK ${enforcer.requireJavaVersion} or newer.</message>
+                                </requireJavaVersion>
+                                <requirePluginVersions>
+                                    <banLatest>true</banLatest>
+                                    <banRelease>true</banRelease>
+                                    <banSnapshots>true</banSnapshots>
+                                    <message>Every plugin must declare an explicit non-LATEST/RELEASE version. See PR-7.1 (exec-plugin drift) for the lesson.</message>
+                                </requirePluginVersions>
+                            </rules>
+                            <fail>true</fail>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <!-- Java compilation -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>