diff --git a/build.gradle.kts b/build.gradle.kts
index 9e9292f..c72da52 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -61,6 +61,15 @@ dependencies {
   testImplementation(libs.spring.boot.starter.web)
   // Gradle 9 requires the platform launcher on the test runtime (boot docs convention).
   testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+
+  // The Boot 3.5.16 BOM manages Tomcat 10.1.55 (test scope only, not in the adapter POM);
+  // 10.1.61 fixes GHSA-f525-44xv-f2qj, GHSA-9xv2-5v5q-p794, GHSA-gcx9-497g-6cp6 and
+  // GHSA-h3x4-894j-xpx5.
+  constraints {
+    testImplementation("org.apache.tomcat.embed:tomcat-embed-core:10.1.61")
+    testImplementation("org.apache.tomcat.embed:tomcat-embed-el:10.1.61")
+    testImplementation("org.apache.tomcat.embed:tomcat-embed-websocket:10.1.61")
+  }
 }
 
 tasks.test {
diff --git a/gradle.lockfile b/gradle.lockfile
index eb86453..7a032b7 100644
--- a/gradle.lockfile
+++ b/gradle.lockfile
@@ -66,9 +66,9 @@ net.minidev:accessors-smart:2.5.2=testCompileClasspath,testRuntimeClasspath
 net.minidev:json-smart:2.5.2=testCompileClasspath,testRuntimeClasspath
 org.apache.logging.log4j:log4j-api:2.24.3=testCompileClasspath,testRuntimeClasspath
 org.apache.logging.log4j:log4j-to-slf4j:2.24.3=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat.embed:tomcat-embed-core:10.1.55=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat.embed:tomcat-embed-el:10.1.55=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat.embed:tomcat-embed-websocket:10.1.55=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat.embed:tomcat-embed-core:10.1.61=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat.embed:tomcat-embed-el:10.1.61=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat.embed:tomcat-embed-websocket:10.1.61=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.assertj:assertj-core:3.27.7=testCompileClasspath,testRuntimeClasspath
 org.awaitility:awaitility:4.2.2=testCompileClasspath,testRuntimeClasspath
diff --git a/osv-scanner.toml b/osv-scanner.toml
index 24fbe33..73862f3 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -10,7 +10,7 @@
 # com.guard-core:guard-core (compile) and kotlin-reflect (compile) - proven in
 # the engine repo's docs/release-rehearsal.md POM audit. Everything below is
 # a test-scope package that consumers resolve at their own Boot-managed
-# versions (spring-webmvc, tomcat, jackson, log4j-api).
+# versions (spring-webmvc, jackson, log4j-api).
 
 # --- spring-webmvc 6.2.19: compileOnly + test-scope here (testImplementation
 # spring-boot-starter-web); NOT shipped by the adapter POM. Consumers resolve
@@ -25,21 +25,6 @@ reason = "spring-webmvc 6.2.19 is compileOnly/test-scope in this repo and not sh
 id = "GHSA-pc63-qcmh-9cmg"
 reason = "spring-webmvc 6.2.19 is compileOnly/test-scope in this repo and not shipped by the adapter POM; consumers resolve their own Boot-managed version; fix train is the Boot 4 line per OSV"
 
-# --- tomcat-embed-core 10.1.55: test-scope only (spring-boot-starter-test);
-# not shipped by the adapter POM; consumers resolve their own container.
-
-[[IgnoredVulns]]
-id = "GHSA-9xv2-5v5q-p794"
-reason = "tomcat-embed-core 10.1.55 is test-scope (spring-boot-starter-test) and not shipped by the adapter POM; consumers resolve their own container version"
-
-[[IgnoredVulns]]
-id = "GHSA-gcx9-497g-6cp6"
-reason = "tomcat-embed-core 10.1.55 is test-scope (spring-boot-starter-test) and not shipped by the adapter POM; consumers resolve their own container version"
-
-[[IgnoredVulns]]
-id = "GHSA-h3x4-894j-xpx5"
-reason = "tomcat-embed-core 10.1.55 is test-scope (spring-boot-starter-test) and not shipped by the adapter POM; consumers resolve their own container version"
-
 # --- jackson 2.21.4 (databind + core): test-scope only
 # (spring-boot-starter-test); not shipped by the adapter POM; consumers
 # resolve their own Boot-managed jackson.