diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d1d6193..9d62a0e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,11 +19,11 @@ jobs:
       security-events: write
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with: { java-version: '21', distribution: temurin }
-      - uses: github/codeql-action/init@v4.37.7
+      - uses: github/codeql-action/init@v4.37.8
         with: { languages: java, queries: +security-and-quality }
       - name: Build with Maven
         run: mvn --batch-mode --no-transfer-progress compile
-      - uses: github/codeql-action/analyze@v4.37.7
+      - uses: github/codeql-action/analyze@v4.37.8
         with: { category: "/language:java" }
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index f73c54c..ae608fa 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -17,7 +17,7 @@ permissions: read-all
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.0"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.1"
     permissions:
       actions: read
       contents: read
@@ -25,7 +25,7 @@ jobs:
 
   scan-pr:
     if: ${{ github.event_name == 'pull_request' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.0"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.1"
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1d40349..1968ed0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -170,7 +170,7 @@ jobs:
     environment: maven-central
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: temurin
@@ -211,7 +211,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: temurin
@@ -232,7 +232,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: temurin
@@ -252,7 +252,7 @@ jobs:
         java-version: ['21']
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           java-version: ${{ matrix.java-version }}
           distribution: temurin
@@ -290,7 +290,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with: { java-version: '21', distribution: temurin, cache: maven }
       - name: Test under vmlens
         run: mvn --batch-mode --no-transfer-progress -Pvmlens test
@@ -309,7 +309,7 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with: { java-version: '21', distribution: temurin, cache: maven }
       - uses: actions/download-artifact@v8
         with: { name: jacoco-report, path: target/site/jacoco/ }
@@ -383,7 +383,7 @@ jobs:
     environment: maven-central
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: temurin
@@ -468,7 +468,7 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: temurin
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ebc0ab4..dfe8425 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -43,6 +43,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@v4.37.7
+        uses: github/codeql-action/upload-sarif@v4.37.8
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index 28aefdd..82271cd 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           java-version: 21
           distribution: 'zulu'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b5ec5c..c82c133 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Cancellable pipeline start-gate via a `startgate` GitHub Environment with configurable wait timer.
 
 ### Changed
+- Build plugins bumped to latest stable: `com.diffplug.spotless:spotless-maven-plugin` 3.9.0 → 3.10.0,
+  `com.github.spotbugs:spotbugs-maven-plugin` 4.10.3.0 → 4.10.4.0 (restores parity with the
+  cross-repo tool-version matrix).
+- CI actions bumped to latest: `actions/setup-java` v5 → v6, `github/codeql-action/*` v4.37.7 →
+  v4.37.8, `google/osv-scanner-action` reusable workflows v2.5.0 → v2.5.1.
 - CI `publish.yml`: added `check-snapshot`/`check-tag` gate jobs to fix release routing.
 - CI `publish.yml`: `softprops/action-gh-release` bumped from v2 to v3.
 - CI `publish.yml`: `org.codehaus.mojo:exec-maven-plugin` bumped to 3.6.3.
diff --git a/pom.xml b/pom.xml
index a11cdaf..8a1de96 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,9 +34,9 @@ SPDX-License-Identifier: Apache-2.0
         <nullaway.version>0.13.8</nullaway.version>
         <jspecify.version>1.0.1</jspecify.version>
         <checker.version>4.2.2</checker.version>
-        <spotless.version>3.9.0</spotless.version>
+        <spotless.version>3.10.0</spotless.version>
         <palantir-java-format.version>2.96.0</palantir-java-format.version>
-        <spotbugs.version>4.10.3.0</spotbugs.version>
+        <spotbugs.version>4.10.4.0</spotbugs.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
         <archunit.version>1.5.0</archunit.version>