diff --git a/app/proprietary/build.gradle b/app/proprietary/build.gradle
index d2028f7859..4c3240369f 100644
--- a/app/proprietary/build.gradle
+++ b/app/proprietary/build.gradle
@@ -59,7 +59,7 @@ dependencies {
     runtimeOnly "io.jsonwebtoken:jjwt-impl:${jwtVersion}"
     runtimeOnly "io.jsonwebtoken:jjwt-jackson:${jwtVersion}"
     runtimeOnly 'com.h2database:h2:2.3.232' // Don't upgrade h2database - file format incompatible with 2.4.x, would break existing user databases
-    runtimeOnly 'org.postgresql:postgresql:42.7.11'
+    runtimeOnly "org.postgresql:postgresql:${postgresqlVersion}"
     implementation('com.coveo:saml-client:5.0.0') {
         exclude group: 'org.opensaml', module: 'opensaml-core'
     }
diff --git a/build.gradle b/build.gradle
index beb90e7849..72fb7fc588 100644
--- a/build.gradle
+++ b/build.gradle
@@ -45,13 +45,13 @@ ext {
     awsSdkVersion = "2.44.12"
     testcontainersMinioVersion = "1.21.4"
     // Security CVE overrides for Spring Boot 4 BOM-managed transitives
-    nettyVersion = "4.2.15.Final"
-    jackson2Version = "2.22.0"
-    // jackson-annotations ships 2-component versions (2.22, not 2.22.0)
+    nettyVersion = "4.2.16.Final"
+    jackson2Version = "2.22.1"
+    // jackson-annotations ships 2-component versions (2.22, not 2.22.1)
     jackson2AnnotationsVersion = "2.22"
-    // Jackson 3 (tools.jackson) used by Spring Boot 4; 3.1.4 patches CVE-2026-54512..54518
-    jackson3Version = "3.1.4"
-    postgresqlVersion = "42.7.11"
+    // Jackson 3 (tools.jackson) used by Spring Boot 4; stays on Spring's 3.1.x line
+    jackson3Version = "3.1.5"
+    postgresqlVersion = "42.7.13"
     // velocity-engine-core 2.3 (via shib-velocity SAML stack) shades a vulnerable
     // commons-io 2.8.0 (CVE-2024-47554) into its jar; 2.4.1 no longer shades it
     velocityVersion = "2.4.1"
@@ -241,36 +241,27 @@ subprojects {
         resolutionStrategy.force "commons-io:commons-io:${commonsIoVersion}"
         // CVE-2024-47554: velocity-engine-core 2.3 shades commons-io 2.8.0; 2.4.1 unshades it
         resolutionStrategy.force "org.apache.velocity:velocity-engine-core:${velocityVersion}"
-        // Jackson 2 is transitive-only here (jinjava, opensaml, jjwt request older versions);
-        // pin the family to a current release and keep modules aligned.
-        resolutionStrategy.force "com.fasterxml.jackson.core:jackson-core:${jackson2Version}"
-        resolutionStrategy.force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}"
-        resolutionStrategy.force "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:${jackson2Version}"
-        resolutionStrategy.force "com.fasterxml.jackson.datatype:jackson-datatype-jdk8:${jackson2Version}"
-        resolutionStrategy.force "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${jackson2Version}"
         // Keep BouncyCastle modules aligned to avoid runtime linkage errors
         resolutionStrategy.force "org.bouncycastle:bcprov-jdk18on:${bouncycastleVersion}"
         resolutionStrategy.force "org.bouncycastle:bcpkix-jdk18on:${bouncycastleVersion}"
         resolutionStrategy.force "org.bouncycastle:bcutil-jdk18on:${bouncycastleVersion}"
         resolutionStrategy.eachDependency { details ->
-            // Netty 4.2.x: CVE-2026-44249/45416/45673/45674/47244/47691/48043/50010/50020/50560
-            // /42579/42580/42581/42583/42584/42585/42587/41417 - force 4.2.15.Final across all modules
+            // Netty: GHSA-gcjf-9mgh-3p7g/q4f6-jm68-57ww/4mp9-239f-g9hg/6cqp-g7gg-8hr5 need 4.2.16+
             if (details.requested.group == "io.netty") {
                 details.useVersion nettyVersion
-                details.because "CVE-2026 netty fixes (>=4.2.15.Final)"
+                details.because "netty CVE fixes (>=4.2.16.Final)"
             }
-            // Jackson 2.x: CVE-2026-54512/54513/54514/54515/54516/54517/54518 - force 2.22.0.
-            // jackson-annotations uses 2-component versions (2.22), unlike core/databind (2.22.0).
+            // Jackson 2.x: GHSA-5gvw-p9qm-jgwh (@JsonView bypass) fixed in 2.22.1.
+            // jackson-annotations uses 2-component versions (2.22), unlike core/databind.
             if (details.requested.group.startsWith("com.fasterxml.jackson")) {
                 details.useVersion(details.requested.name == "jackson-annotations"
                     ? jackson2AnnotationsVersion : jackson2Version)
-                details.because "CVE-2026-54512..54518 jackson 2.x fixes (>=2.22.0)"
+                details.because "jackson 2.x CVE fixes (>=2.22.1)"
             }
-            // Jackson 3 (tools.jackson) ships with Spring Boot 4; same CVE-2026-54512..54518
-            // family is fixed in 3.1.4 (stays in Spring Boot's 3.1.x line).
+            // Jackson 3 (tools.jackson) ships with Spring Boot 4; same advisory fixed in 3.1.5
             if (details.requested.group.startsWith("tools.jackson")) {
                 details.useVersion jackson3Version
-                details.because "CVE-2026-54512..54518 jackson 3.x fixes (>=3.1.4)"
+                details.because "jackson 3.x CVE fixes (>=3.1.5)"
             }
         }
     }
@@ -282,7 +273,7 @@ subprojects {
         dependencies {
             // Override BOM-managed commons-lang3 for CVE-2025-48924 fix
             dependency "org.apache.commons:commons-lang3:$commonsLang3"
-            // CVE-2026-42198: Spring Boot 4 BOM pins postgresql 42.7.10; override to patched 42.7.11
+            // GHSA-j92g-9f8w-j867 (channel-binding downgrade): BOM pins 42.7.10, needs 42.7.12+
             dependency "org.postgresql:postgresql:$postgresqlVersion"
         }
     }
diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile
index 37d46f4cca..dc23ede0d1 100644
--- a/docker/backend/Dockerfile
+++ b/docker/backend/Dockerfile
@@ -43,7 +43,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
       --no-daemon
 
 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile
index e46d2a70c1..130a7958db 100644
--- a/docker/base/Dockerfile
+++ b/docker/base/Dockerfile
@@ -365,7 +365,7 @@ RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
 
 
 # Final runtime image - the actual base image
-FROM eclipse-temurin:25-jre-noble@sha256:f9bd8815e73632c22985ebb133ec49b9fc4ad5ffe0657594ac02748ad0431ab7 AS runtime
+FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS runtime
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index cbd0de0bdc..74be081169 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -59,7 +59,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
       --no-daemon
 
 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble@sha256:f9bd8815e73632c22985ebb133ec49b9fc4ad5ffe0657594ac02748ad0431ab7 AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index aa51222327..31328ce1ae 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -54,7 +54,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
       --no-daemon
 
 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite
index a22fa9414b..dea812cccb 100644
--- a/docker/embedded/Dockerfile.ultra-lite
+++ b/docker/embedded/Dockerfile.ultra-lite
@@ -55,7 +55,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
 
 # Stage 2: Runtime image
 # glibc base (not Alpine/musl): JPDFium's PDFium natives are glibc-linked.
-FROM eclipse-temurin:25-jre-noble@sha256:f9bd8815e73632c22985ebb133ec49b9fc4ad5ffe0657594ac02748ad0431ab7
+FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175
 
 ENV DEBIAN_FRONTEND=noninteractive \
     LANG=C.UTF-8 \