diff --git a/pom.xml b/pom.xml
index 9fae352a..2da4f6e6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -29,7 +29,7 @@
         <!--    For HTML manipulation-->
         <jsoup.version>1.23.2</jsoup.version>
         <!--    For format identification (DROID from the UK National Archives)-->
-        <droid.version>6.8.0</droid.version>
+        <droid.version>6.9.14</droid.version>
         <droidjaxb-impl.version>2.3.8</droidjaxb-impl.version>
         <!--    For Windows shortcut manipulation TODO: exotic library to replace-->
         <mslinks.version>1.0.6.2</mslinks.version>
diff --git a/sedalib/pom.xml b/sedalib/pom.xml
index 5aa134a4..a13c7770 100644
--- a/sedalib/pom.xml
+++ b/sedalib/pom.xml
@@ -44,13 +44,26 @@
                     <groupId>org.apache.logging.log4j</groupId>
                     <artifactId>log4j-slf4j2-impl</artifactId>
                 </exclusion>
-                <!--bcprov-jdk15on is an end-of-life branch stuck on 1.68 with unpatched CVEs.
-                    truevfs-comp-zip only needs the org.bouncycastle.crypto classes, which the
-                    maintained bcprov-jdk18on artifact provides under the same package names.-->
+                <!--bcprov-jdk15on and bcprov-jdk15to18 are end-of-life branches stuck on old
+                    versions with unpatched CVEs. truevfs-comp-zip and jwat-common only need the
+                    org.bouncycastle classes, which the maintained bcprov-jdk18on artifact provides
+                    under the same package names.-->
                 <exclusion>
                     <groupId>org.bouncycastle</groupId>
                     <artifactId>bcprov-jdk15on</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15to18</artifactId>
+                </exclusion>
+                <!--Droid 6.9 added S3 profile support, which drags in the whole AWS SDK and, through
+                    netty-nio-client, netty. droid-core-interfaces declares eight artifacts of that
+                    group, so excluding s3 alone left netty reachable through sso. Sedatools only
+                    identifies files on the local filesystem, so the whole group is kept out.-->
+                <exclusion>
+                    <groupId>software.amazon.awssdk</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <!--Replacement for the excluded, end-of-life bcprov-jdk15on needed by truevfs-comp-zip-->