diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index acb420b..d14be11 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -13,8 +13,8 @@ commons-cli = "1.11.0"
 pdfbox = "3.0.7"
 slf4j = "2.0.18"
 junit = "6.1.0"
-errorprone = "2.49.0"
-nullaway = "0.13.6"
+errorprone = "2.50.0"
+nullaway = "0.13.7"
 jspecify = "1.0.0"
 archunit = "1.4.2"
 # google-java-format: was inlined in despeckle's quality script and pinned in register's catalog;
@@ -31,9 +31,9 @@ system-stubs = "2.1.8"
 awaitility = "4.3.0"
 
 # --- Plugin marker versions (read by build-logic/build.gradle.kts and by `version.ref` below) ---
-spotless = "8.6.0"
+spotless = "8.7.0"
 errorprone-plugin = "5.1.0"
-spotbugs-plugin = "6.5.5"
+spotbugs-plugin = "6.5.8"
 # SpotBugs analysis-engine version (distinct from the Gradle plugin marker above); was inlined in
 # tate-yoko-pdf's quality script. The unified quality convention sets spotbugs.toolVersion from here.
 spotbugs-tool = "4.9.6"
@@ -43,16 +43,16 @@ shadow = "9.4.2"
 # Spring Boot Gradle plugin (bootRun/bootJar) for the :webapp:app web front end. Boot 4.0 (Spring
 # Framework 7) baselines Java 17 with first-class Java 25 support. Applied only in :webapp:app via
 # `alias(libs.plugins.springBoot)`; it imports its own dependency BOM for spring-boot-starter-*.
-spring-boot = "4.0.6"
+spring-boot = "4.1.0"
 # springdoc-openapi (Swagger UI + /v3/api-docs) for the :webapp:app REST API. The 3.0.x line targets
 # Spring Boot 4 / Jackson 3 (2.8.x is the Boot 3 line). App-only dep; not BOM-managed by Spring Boot.
 springdoc = "3.0.3"
-rewrite-plugin = "7.34.0"
-rewrite-recipe-bom = "3.32.0"
+rewrite-plugin = "7.35.0"
+rewrite-recipe-bom = "3.33.0"
 # rewrite-java-security is the one recipe module not managed by the recipe BOM, so its version is
 # pinned here. Compatibility comes from it depending on the same rewrite-bom (rewrite-core) line as
 # the recipe BOM — verify that shared line on each bump; the matching 3.31.0 numbers are incidental.
-rewrite-java-security = "3.32.0"
+rewrite-java-security = "3.33.1"
 
 # PIT mutation testing. ADOPTED FROM DESPECKLE (camelCase leaves, NOT dashed). `pitest` is the PIT
 # analysis tool version; `pitestJunit5Plugin` is the JUnit 5 bridge. Both are single camelCase
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index bd82f36..65d8749 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=bafc141b619ad6350fd975fc903156dd5c151998cc8b058e8c1044ab5f7b031f
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
+distributionSha256Sum=bbaeb2fef8710818cf0e261201dab964c572f92b942812df0c3620d62a529a01
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
diff --git a/gradlew b/gradlew
index b9bb139..249efbb 100755
--- a/gradlew
+++ b/gradlew
@@ -20,7 +20,7 @@
 
 ##############################################################################
 #
-#   Gradle start up script for POSIX generated by Gradle.
+#   gradlew start up script for POSIX generated by Gradle.
 #
 #   Important for running:
 #
@@ -29,7 +29,7 @@
 #       bash, then to run this script, type that shell name before the whole
 #       command line, like:
 #
-#           ksh Gradle
+#           ksh gradlew
 #
 #       Busybox and similar reduced shells will NOT work, because this script
 #       requires all of these POSIX shell features:
diff --git a/gradlew.bat b/gradlew.bat
index aa5f10b..8508ef6 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -19,7 +19,7 @@
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
-@rem  Gradle startup script for Windows
+@rem  gradlew startup script for Windows
 @rem
 @rem ##########################################################################
 
@@ -72,7 +72,7 @@ echo location of your Java installation. 1>&2
 
 
 
-@rem Execute Gradle
+@rem Execute gradlew
 @rem endlocal doesn't take effect until after the line is parsed and variables are expanded
 @rem which allows us to clear the local environment before executing the java command
 endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel