diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index cb033aa..ba7f05f 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -21,9 +21,9 @@ jspecify = "1.0.0"
 
 # Runtime — pk-auth-core
 webauthn4j = "0.31.5.RELEASE"
-nimbus-jose-jwt = "10.9"
-jackson = "3.1.3"
-jackson-annotations = "2.21"
+nimbus-jose-jwt = "10.9.1"
+jackson = "3.1.4"
+jackson-annotations = "2.22"
 caffeine = "3.2.4"
 micrometer = "1.16.5"
 slf4j = "2.0.18"
@@ -33,10 +33,10 @@ argon2-jvm = "2.12"
 
 # Persistence
 jdbi = "3.53.0"
-flyway = "12.6.2"
+flyway = "12.7.0"
 postgresql = "42.7.11"
 hikaricp = "7.0.2"
-aws-sdk = "2.45.0"
+aws-sdk = "2.45.1"
 testcontainers = "1.21.4"
 
 # Spring Boot adapter (Phase 8). Spring Boot 4 / Spring Security 7. Spring Boot 4 standardized
@@ -62,7 +62,7 @@ micronaut = "4.10.23"
 # Jetty 12 / Jersey 4 (EE 10); the adapter rides the parent's `dropwizard-jackson` which is still
 # Jackson 2 — `PkAuthJacksonBridge` continues to translate the wire types until a future
 # Dropwizard major moves to Jackson 3 (`tools.jackson.*`).
-dropwizard = "5.0.1"
+dropwizard = "5.0.2"
 
 # Dagger 2 wires the Dropwizard adapter at compile time. Brief §3 mandates Dagger over Guice/HK2;
 # ADR 0004 explains the rationale.
@@ -76,7 +76,7 @@ jakarta-inject = "2.0.1"
 junit-jupiter = "6.1.0"
 assertj = "3.27.7"
 mockito = "5.23.0"
-logback = "1.5.33"
+logback = "1.5.34"
 
 [libraries]
 jspecify = { module = "org.jspecify:jspecify", version.ref = "jspecify" }