diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ec3357..7f58e84 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,8 +13,13 @@ jobs:
       contents: write
       pull-requests: write
     with:
-      otp-version: '28.0.1'
-      rebar3-version: '3.27.0'
+      version-file: '.tool-versions'
+      # version-file drives analysis jobs; the eunit/ct matrix needs otp-matrix
+      # (else it falls back to the otp-version default of 28). And meck is a
+      # test-only dep absent from rebar.lock, so a stale OTP-28-era meck is
+      # restored from cache and fails on OTP 29 - drop it so it re-resolves.
+      otp-matrix: '["29.0.2"]'
+      pre-test-command: 'rm -rf _build/test/lib/meck'
       enable-audit: true
       enable-dependency-submission: true
       enable-summary: true
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 59d1ae0..d6c2653 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -25,8 +25,8 @@ jobs:
 
       - uses: erlef/setup-beam@v1
         with:
-          otp-version: '28.0.1'
-          rebar3-version: '3.27.0'
+          version-file: '.tool-versions'
+          version-type: strict
 
       - name: Cache _build
         uses: actions/cache@v4
diff --git a/.gitignore b/.gitignore
index cd1f196..c581bf6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,5 +4,4 @@ _checkouts/
 rebar3.crashdump
 erl_crash.dump
 CLAUDE.md
-.tool-versions
 doc/
diff --git a/.tool-versions b/.tool-versions
new file mode 100644
index 0000000..745f93b
--- /dev/null
+++ b/.tool-versions
@@ -0,0 +1,2 @@
+erlang 29.0.2
+rebar 3.27.0
diff --git a/rebar.config b/rebar.config
index c65e170..150b414 100644
--- a/rebar.config
+++ b/rebar.config
@@ -12,7 +12,10 @@
 
 {deps, [
     {asobi, {git, "https://github.com/widgrensit/asobi.git", {branch, "main"}}},
-    {luerl, "~> 1.5"}
+    {luerl, "~> 1.5"},
+    %% Force the cowlib advisory fix (GHSA-g2wm-735q-3f56). cowboy 2.15.0 pins
+    %% cowlib 2.16.1 transitively; promote it to the patched 2.17.x.
+    {cowlib, "~> 2.17"}
 ]}.
 
 {relx, [
@@ -34,10 +37,18 @@
         ]}
     ]},
     {test, [
-        {erl_opts, [nowarn_export_all, nowarn_missing_spec, warnings_as_errors, {i, "test"}]},
+        %% nowarn_deprecated_catch: OTP 29 deprecates `catch Expr`; test teardown
+        %% uses it for fire-and-forget cleanup. Suppress in tests only (src is catch-free).
+        {erl_opts, [
+            nowarn_export_all,
+            nowarn_missing_spec,
+            nowarn_deprecated_catch,
+            warnings_as_errors,
+            {i, "test"}
+        ]},
         {deps, [
             {nova_test, {git, "https://github.com/novaframework/nova_test.git", {branch, "main"}}},
-            {meck, "~> 0.9"},
+            {meck, "~> 1.2"},
             {proper, "~> 1.4"}
         ]},
         {ct_opts, [{sys_config, "./config/dev_sys.config.src"}]},
diff --git a/rebar.lock b/rebar.lock
index b020ba9..95a23a6 100644
--- a/rebar.lock
+++ b/rebar.lock
@@ -1,17 +1,17 @@
 {"1.2.0",
 [{<<"asobi">>,
   {git,"https://github.com/widgrensit/asobi.git",
-       {ref,"0258d582ff8bcbcc6bf4464b5004dd37fcf90bfe"}},
+       {ref,"92518c785d4b2fae1dc28dbf16c97dd9e5fb49d9"}},
   0},
  {<<"backoff">>,{pkg,<<"backoff">>,<<"1.1.6">>},3},
  {<<"cowboy">>,{pkg,<<"cowboy">>,<<"2.15.0">>},2},
- {<<"cowlib">>,{pkg,<<"cowlib">>,<<"2.17.1">>},3},
+ {<<"cowlib">>,{pkg,<<"cowlib">>,<<"2.17.1">>},0},
  {<<"erlydtl">>,{pkg,<<"erlydtl">>,<<"0.14.0">>},2},
  {<<"jhn_stdlib">>,{pkg,<<"jhn_stdlib">>,<<"5.11.2">>},2},
  {<<"jose">>,{pkg,<<"jose">>,<<"1.11.12">>},3},
  {<<"kura">>,
   {git,"https://github.com/Taure/kura.git",
-       {ref,"64c487a02596e082ee0968f7f14b5ac8090ebc02"}},
+       {ref,"fdb1abc5fdc0cc48c34b7d33fd8e0d6748c4a7d1"}},
   1},
  {<<"kura_postgres">>,
   {git,"https://github.com/Taure/kura_postgres.git",