diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 99908a1..35529b2 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -16,7 +16,7 @@ java = "21"
 # Gradle build cache stays disabled (see gradle.properties) — `./gradlew check` itself runs clean
 # on 8.x. The earlier 7.x pin (and its dependabot ignore) has been retired.
 spotless = "8.10.4"
-errorprone-plugin = "5.1.1"
+errorprone-plugin = "5.2.0"
 errorprone-core = "2.51.0"
 google-java-format = "1.36.1"
 jspecify = "1.0.1"
@@ -35,10 +35,10 @@ argon2-jvm = "2.12"
 
 # Persistence
 jdbi = "3.55.0"
-flyway = "13.11.1"
+flyway = "13.12.0"
 postgresql = "42.7.14"
 hikaricp = "7.1.0"
-aws-sdk = "2.57.3"
+aws-sdk = "2.57.8"
 testcontainers = "1.21.4"
 
 # Spring Boot adapter (Phase 8). Spring Boot 4 / Spring Security 7. Spring Boot 4 standardized
@@ -58,7 +58,7 @@ h2 = "2.5.252"
 # `@Filter` validating the JWT against pk-auth-jwt's PkAuthJwtValidator is sufficient.
 # Micronaut 5.x requires JVM 25; we target Java 21 (brief §3), so 5.x is pinned out via
 # .github/dependabot.yml until the project moves to a newer JDK baseline.
-micronaut = "4.10.34"
+micronaut = "4.10.35"
 
 # Dropwizard adapter (Phase 9). Brief §6.11 tracks the latest Dropwizard release. 5.x adds
 # Jetty 12 / Jersey 4 (EE 10); the adapter rides the parent's `dropwizard-jackson` which is still