diff --git a/.github/renovate-config.js b/.github/renovate-config.js
index 9c4b3bd..cdec50a 100644
--- a/.github/renovate-config.js
+++ b/.github/renovate-config.js
@@ -32,6 +32,12 @@ module.exports = {
       matchManagers: ["gradle", "gradle-wrapper"],
       allowedVersions: "/^\\d+(?:\\.\\d+)+$/",
     },
+    {
+      description: "Pin JDK version to 17",
+      matchManagers: ["github-actions"],
+      matchPackageNames: ["java-jdk"],
+      allowedVersions: "17",
+    },
     {
       description: "Pin Error Prone to 2.42.x (last version supporting JDK 17)",
       matchManagers: ["gradle"],
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 2f18d8f..3839897 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -23,7 +23,7 @@ jobs:
           private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
 
       - name: Renovate
-        uses: renovatebot/github-action@v46.2.5
+        uses: renovatebot/github-action@v46.2.6
         with:
           configurationFile: .github/renovate-config.js
           token: ${{ steps.automation-token.outputs.token }}
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 05ca125..6c13d60 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -1,12 +1,12 @@
 [versions]
 arrow = "2.2.3"
-binary-compatibility-validator = "0.18.1"
+binary-compatibility-validator = "0.18.2"
 dokka = "2.2.0"
 errorprone = "2.42.0" # DO NOT upgrade beyond 2.42.0 — it is the last version supporting JDK 17
 errorprone-plugin = "5.1.1"
 jetbrains-annotations = "26.1.0"
 jspecify = "1.0.1"
-kotlin = "2.4.10"
+kotlin = "2.4.20"
 kover = "0.9.9"
 nullaway = "0.14.1"
 nullaway-plugin = "3.2.0"