diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index d41efa1..237583e 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -15,7 +15,7 @@ java = "21"
 # intermittently fail class loading on Gradle 9 / JDK 21 under a *cached* build, which is why the
 # Gradle build cache stays disabled (see gradle.properties) — `./gradlew check` itself runs clean
 # on 8.x. The earlier 7.x pin (and its dependabot ignore) has been retired.
-spotless = "8.9.0"
+spotless = "8.10.0"
 errorprone-plugin = "5.1.0"
 errorprone-core = "2.50.0"
 google-java-format = "1.25.2"
@@ -27,7 +27,7 @@ nimbus-jose-jwt = "10.9.1"
 jackson = "3.2.2"
 jackson-annotations = "2.22"
 caffeine = "3.2.4"
-micrometer = "1.17.0"
+micrometer = "1.17.1"
 slf4j = "2.0.18"
 
 # Alt-flow modules
@@ -38,7 +38,7 @@ jdbi = "3.54.0"
 flyway = "13.3.0"
 postgresql = "42.7.13"
 hikaricp = "7.1.0"
-aws-sdk = "2.53.1"
+aws-sdk = "2.54.2"
 testcontainers = "1.21.4"
 
 # Spring Boot adapter (Phase 8). Spring Boot 4 / Spring Security 7. Spring Boot 4 standardized
@@ -46,8 +46,8 @@ testcontainers = "1.21.4"
 # previous Jackson 2 bridge module is gone, replaced by direct registration of the core's
 # `PkAuthObjectMappers.pkAuthModule()` as a Spring bean. Brief §6.10 originally specified
 # 3.5.x / 6.5.x; the upgrade landed as a deliberate framework refresh.
-spring-boot = "4.1.0"
-spring-security = "7.1.0"
+spring-boot = "4.1.1"
+spring-security = "7.1.1"
 # H2 in the demo so reviewers can run the spring-boot-demo without an external Postgres.
 # Confined to the demo's runtime; the starter does not pull it in.
 h2 = "2.4.240"
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 84c5a9c..760c459 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=84fbba45c7f4c64abc77460e1c00f541e9f960e3c7ed2538f1ede19eacd873ae
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.0-bin.zip
+distributionSha256Sum=acd53f1edaf02f1a8ff99879f8a34b302661a057d9b063ae9e35b552f804d20a
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500