diff --git a/changelog/unreleased/owasp-nvd-apikey.yml b/changelog/unreleased/owasp-nvd-apikey.yml
new file mode 100644
index 00000000000..2892a3d3708
--- /dev/null
+++ b/changelog/unreleased/owasp-nvd-apikey.yml
@@ -0,0 +1,11 @@
+title: >
+  The `./gradlew owasp` dependency vulnerability check now supports an NVD API key
+  (via `-PnvdApiKey` or `NVD_API_KEY`), and requires `--no-parallel` due to an upstream
+  Gradle plugin issue. See dev-docs/FAQ.adoc for details.
+type: other
+authors:
+  - name: Eric Pugh
+links:
+  - name: PR#4725
+    url: https://github.com/apache/solr/pull/4725
+
diff --git a/dev-docs/FAQ.adoc b/dev-docs/FAQ.adoc
index 0690f557e5c..f4e98b90cc9 100644
--- a/dev-docs/FAQ.adoc
+++ b/dev-docs/FAQ.adoc
@@ -74,7 +74,12 @@ Learn more about using Forbidden APIs via `./gradlew :helpForbiddenApis`.
 To run a check for dependencies of Solr that have security vulnerabilities using the https://plugins.gradle.org/plugin/org.owasp.dependencycheck[OWASP] Gradle plugin.
 Run via:
 
-`./gradlew owasp`
+`./gradlew owasp --no-parallel`
+
+This task downloads the NVD CVE database, which is heavily rate-limited for unauthenticated requests and will fail with an error from `NvdApiDataSource` without an API key.
+Request a free key at https://nvd.nist.gov/developers/request-an-api-key and pass it via `-PnvdApiKey=<your-key>` or the `NVD_API_KEY` environment variable.
+
+The `--no-parallel` flag is required because of an unresolved upstream bug where `dependencyCheckAggregate` resolves other projects' configurations unsafely under Gradle's parallel project execution: https://github.com/dependency-check/dependency-check-gradle/issues/462
 
 There are a number of other tasks that get run to validate the source code, and you can find them in the ./gradle/validation source tree.
 
diff --git a/dev-docs/gradle-help/workflow.txt b/dev-docs/gradle-help/workflow.txt
index 47cde864f53..0c5c2d1142b 100644
--- a/dev-docs/gradle-help/workflow.txt
+++ b/dev-docs/gradle-help/workflow.txt
@@ -53,6 +53,7 @@ Other validation and checks
 Generate a report of dependencies with known OWASP vulnerabilities:
 gradlew :dependencyCheckAnalyze
 open ./build/reports/dependency-check-report.html
+(requires an NVD API key, see dev-docs/FAQ.adoc)
 
 Additional General Options
 ==========================
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 0c06757df4b..7f82ce16a6c 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -182,7 +182,7 @@ opentelemetry-runtime-telemetry = "2.27.0-alpha"
 oshai-logging = "8.0.4"
 # @keep for version alignment
 ow2-asm = "9.10.1"
-owasp-dependencycheck = "12.2.2"
+owasp-dependencycheck = "13.0.0"
 # @keep for version alignment
 perfmark = "0.27.0"
 prometheus-metrics = "1.8.0"
diff --git a/gradle/validation/owasp-dependency-check.gradle b/gradle/validation/owasp-dependency-check.gradle
index b319dd48a35..cbeec495830 100644
--- a/gradle/validation/owasp-dependency-check.gradle
+++ b/gradle/validation/owasp-dependency-check.gradle
@@ -31,6 +31,11 @@ configure(rootProject) {
     analyzers {
       assemblyEnabled = false
     }
+    nvd {
+      // NVD heavily rate-limits the CVE data feed for unauthenticated requests.
+      // Get a free key from https://nvd.nist.gov/developers/request-an-api-key
+      apiKey = project.findProperty("nvdApiKey") ?: System.getenv("NVD_API_KEY")
+    }
   }
 
   task owasp() {