diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f6ff3d..cfb6f8c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,13 +21,13 @@ jobs:
       GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx2g
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Setup Java
         uses: actions/setup-java@v5
         with:
           distribution: temurin
-          java-version: 21
+          java-version: 25
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
@@ -42,7 +42,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-results
           path: |
@@ -53,7 +53,7 @@ jobs:
 
       - name: Upload coverage report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-report
           path: build/reports/jacoco/**
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8e9472a..a4b3807 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 328ef44..6c5c710 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -54,7 +54,7 @@ jobs:
       CONFIRMATION: ${{ inputs.confirmation }}
     steps:
       - name: Checkout release ref
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.release_ref }}
           fetch-depth: 0
@@ -127,7 +127,7 @@ jobs:
       GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx2g
     steps:
       - name: Checkout release ref
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: ${{ needs.validate.outputs.validated_sha }}
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2e13e0..950da19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ include migration notes.
 
 ## Unreleased
 
+- Updated the Gradle wrapper to 9.6.1, Spotless to 8.8.0, Caffeine to 3.2.4,
+  and JJWT to 0.13.0.
+- Updated CI and release actions to current action majors and aligned CI with Java 25.
+
 - Certified Vigil for Spring Boot 4.1.x, Spring Framework 7.x, Spring Security
   7.1.x, Java 25, Gradle 9.1.x, and Jackson 3.
 - Updated build tooling to Spring Boot 4.1.0, Java 25 toolchains, Gradle 9.1.0,
diff --git a/README.md b/README.md
index c0f716a..a74265c 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Vigil provides JWT lifecycle, request authentication, cookie helpers, tenant con
 
 ## Compatibility
 
-Vigil `7.0.x` supports Java 25, Spring Boot 4.1.x, Spring Framework 7.x, Spring Security 7.1.x, Gradle 9.1.x, and Jackson 3. Vigil `6.0.x` was the final Java 21 / Spring Boot 3.5 line.
+Vigil `7.1.x` supports Java 25, Spring Boot 4.1.x, Spring Framework 7.x, Spring Security 7.1.x, Gradle 9.6.x, and Jackson 3. Vigil `6.0.x` was the final Java 21 / Spring Boot 3.5 line.
 
 `7.1.0` is the current release line. Public consumers should pin an exact version and review the release notes before upgrading.
 
diff --git a/build.gradle.kts b/build.gradle.kts
index 9bdf8c6..9794a2b 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -2,7 +2,7 @@ plugins {
     id("java-library")
     id("org.springframework.boot") version "4.1.0" apply false
     id("io.spring.dependency-management") version "1.1.7"
-    id("com.diffplug.spotless") version "7.0.2"
+    id("com.diffplug.spotless") version "8.8.0"
     id("checkstyle")
     id("jacoco")
     id("com.vanniktech.maven.publish") version "0.34.0"
@@ -42,12 +42,12 @@ dependencies {
     annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")
 
     // JWT - api scope exposes Claims, JwtException to consumers
-    api("io.jsonwebtoken:jjwt-api:0.12.6")
-    runtimeOnly("io.jsonwebtoken:jjwt-impl:0.12.6")
-    runtimeOnly("io.jsonwebtoken:jjwt-jackson:0.12.6")
+    api("io.jsonwebtoken:jjwt-api:0.13.0")
+    runtimeOnly("io.jsonwebtoken:jjwt-impl:0.13.0")
+    runtimeOnly("io.jsonwebtoken:jjwt-jackson:0.13.0")
 
     // Cache (for token blacklist)
-    implementation("com.github.ben-manes.caffeine:caffeine:3.1.8")
+    implementation("com.github.ben-manes.caffeine:caffeine:3.2.4")
 
     // Validation
     implementation("jakarta.validation:jakarta.validation-api")
diff --git a/docs/releases/release-policy.md b/docs/releases/release-policy.md
index c87f98d..4c05bd3 100644
--- a/docs/releases/release-policy.md
+++ b/docs/releases/release-policy.md
@@ -39,7 +39,7 @@ Current tested compatibility envelope:
 - Spring Framework 7.x through Spring Boot 4.1.x;
 - Spring Security 7.1.x through Spring Boot 4.1.x;
 - Jackson 3 through `tools.jackson` packages;
-- Gradle 9.1.x wrapper;
+- Gradle 9.6.x wrapper;
 - HS256 with a configured 256-bit minimum secret;
 - RS256 with configured PEM private/public keys and JWKS publication.
 
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 2e11132..a351597 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.1.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME