diff --git a/app/core/build.gradle b/app/core/build.gradle
index 33aa679994..5e90672f75 100644
--- a/app/core/build.gradle
+++ b/app/core/build.gradle
@@ -57,7 +57,7 @@ dependencies {
     // veraPDF still uses javax.xml.bind, not the new jakarta namespace
     implementation 'javax.xml.bind:jaxb-api:2.3.1'
     implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
-    implementation 'com.sun.xml.bind:jaxb-core:4.0.7'
+    implementation 'com.sun.xml.bind:jaxb-core:4.0.9'
 
     // CVE-2022-25647: Explicit gson to prevent unsafe deserialization (tabula would pull 2.8.7)
     implementation "com.google.code.gson:gson:${gsonVersion}"