diff --git a/Dockerfile b/Dockerfile
index a549528..62e2dc3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # The Gradle build produces an architecture-independent jar, so it runs on the
 # builder's native platform. Without this the whole Kotlin build would run under
 # QEMU for the arm64 image, taking far longer for a byte-identical artifact.
-FROM --platform=$BUILDPLATFORM gradle:9.5.1-jdk21-alpine AS build
+FROM --platform=$BUILDPLATFORM gradle:9.8.1-jdk21-alpine AS build
 WORKDIR /app
 
 # Layer 1: Copy only build scripts for dependency caching
@@ -63,7 +63,7 @@ RUN apk add --no-cache curl && \
 # and dumps the JVM checkpoint to /opt/crac/checkpoint before exiting
 # 137. CI then `docker cp`s the checkpoint dir out and uploads it as
 # an artifact. Production never runs this stage.
-FROM bellsoft/liberica-runtime-container:jdk-21-crac-slim-glibc AS train
+FROM bellsoft/liberica-runtime-container:jdk-21.0.12_11-crac-slim-glibc AS train
 WORKDIR /app
 COPY --from=build /app/api/build/libs/*.jar app.jar
 COPY --from=otel /otel-javaagent.jar otel-javaagent.jar
@@ -77,7 +77,7 @@ ENTRYPOINT ["java", \
     "-javaagent:otel-javaagent.jar", \
     "-jar", "app.jar"]
 
-FROM bellsoft/liberica-runtime-container:jdk-21-crac-slim-glibc
+FROM bellsoft/liberica-runtime-container:jdk-21.0.12_11-crac-slim-glibc
 WORKDIR /app
 # Build-time identity. Passed by the workflow as `--build-arg GIT_SHA=${{ github.sha }}`.
 # The resulting ENV is baked into the image and surfaces to:
diff --git a/api/build.gradle.kts b/api/build.gradle.kts
index c955773..d5e0459 100644
--- a/api/build.gradle.kts
+++ b/api/build.gradle.kts
@@ -32,19 +32,19 @@ dependencies {
     // fires. Spring Boot 4 dropped the `spring-boot-starter-aop`
     // shortcut, so pull the underlying jars directly.
     implementation("org.springframework:spring-aop")
-    implementation("org.aspectj:aspectjweaver:1.9.25.1")
+    implementation("org.aspectj:aspectjweaver:1.9.26")
     implementation("org.springframework.boot:spring-boot-starter-oauth2-authorization-server")
     implementation("org.springframework.boot:spring-boot-starter-validation")
     implementation("org.springframework.boot:spring-boot-starter-data-redis")
     implementation("org.springframework.session:spring-session-data-redis")
     implementation("org.springframework.boot:spring-boot-starter-amqp")
     implementation("org.springframework.boot:spring-boot-starter-mail")
-    implementation("org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3")
+    implementation("org.springdoc:springdoc-openapi-starter-webmvc-ui:3.1.1")
     implementation("org.springframework.boot:spring-boot-starter-flyway")
     implementation("org.flywaydb:flyway-database-postgresql")
     implementation("org.springframework.boot:spring-boot-starter-jooq")
     implementation("org.jooq:jooq")
-    implementation("tools.jackson.module:jackson-module-kotlin:3.1.4")
+    implementation("tools.jackson.module:jackson-module-kotlin:3.2.4")
     runtimeOnly("org.postgresql:postgresql")
     // Tracing runtime jars. With these on the classpath Spring Boot
     // activates micrometer-tracing + the OTLP exporter and starts shipping
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 6262db8..00243b0 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -1,7 +1,7 @@
 [versions]
 jorisjonkers-commons = "0.11.0"
 jorisjonkers-conventions = "0.7.1"
-kotlin = "2.3.21"
+kotlin = "2.4.21"
 
 [libraries]
 kotlin-commons-archunit-test = { module = "dev.jorisjonkers:kotlin-commons-archunit-test", version.ref = "jorisjonkers-commons" }
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index df6a6ad..91c4fc6 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500