diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256
index 923aed0..5f5ae67 100644
--- a/.github/shared-files.sha256
+++ b/.github/shared-files.sha256
@@ -55,12 +55,12 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73  .github/ISSUE_
 9a24b2a67ab8e6f52016093e9b6a89796adea29887b7820accede06cc0c0d170  .github/workflows/publish.yml#code-style
 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52  .java-version
 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .java-version.license
-30b3bed932fd05a34d79af0155166b548a7597e5ee4913aa105dd82a41d1936d  .github/workflows/claude.yml
-de1479c5c1e662c0f01d6afd0d18b4a71e8d8168b377287ca6e93285eef63358  .github/workflows/claude-code-review.yml
-fe768632e9abc1a8cd39b038a77c1a79dbfd036129bb7f0d84b393251b369be6  .github/workflows/scorecard.yml
+48cf852de627f1b11f402e408af907ce3e9ec926f6ba11720467645117e92e3a  .github/workflows/claude.yml
+362d1d169821b8954dc305dac36b8e2437acdbe2921ac42e9887a215663fa666  .github/workflows/claude-code-review.yml
+d4371cbcd6c5511e9b712599bbadc7b4c2437f3107f5d706a9adccdda24c2c44  .github/workflows/scorecard.yml
 480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30  .github/workflows/reuse.yml
 93aedaf67af1c4d63b2502107a51f2f454f2b3b4bc5f2fe892561e12363e57a9  .github/workflows/osv-scanner.yml
-52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a  .github/workflows/codeql.yml
+ed4231dc5b4ba9357a06974cb61e92b60e3eaac9a293810087efb2933e0cac82  .github/workflows/codeql.yml
 c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9  .github/dependabot.yml
 f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1  .github/workflows/publish.yml#startgate
 e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208  .github/workflows/publish.yml#shared-files
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index f19ab4d..c96753c 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -25,7 +25,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
+        uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 1cbdb2b..2600eff 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
+        uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 02f86b7..da8c6ad 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,9 +27,9 @@ jobs:
         with: { java-version: '25', distribution: temurin }
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with: { java-version-file: .java-version, distribution: temurin }
-      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with: { languages: java, queries: +security-and-quality }
       - name: Build with Maven
         run: mvn --batch-mode --no-transfer-progress compile
-      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with: { category: "/language:java" }
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 98e295b..2ffe907 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -43,6 +43,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           sarif_file: results.sarif
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd5bf03..40857c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,8 +41,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   pipelined) and RAC 285/285 unchanged. The `AtomicLong.jml` workaround is gone -- the upstream fix
   (OpenJML/Specs#29) shipped in 21.0.29 -- while `ArrayDeque.jml` was still deleted at install. Class
   invariants still break RAC (now `NoSuchMethodError` on the inner stream classes), so they stay out.
-- Build tooling: `anthropics/claude-code-action` v1.0.255 (from v1.0.252) and Gradle 9.8.2 in the shared
-  `verify-signing-key-gradle` job, in step with the sibling repositories.
+- Build tooling bumped in step with the sibling repositories: `anthropics/claude-code-action` v1.0.258 and
+  `github/codeql-action` v4.39.1. maven-clean-plugin 3.5.0, maven-resources-plugin 3.5.0,
+  maven-install-plugin 3.2.0, maven-deploy-plugin 3.2.0 and maven-dependency-plugin 3.11.0 are now declared:
+  no POM named them, so their versions came from whichever Maven ran the build. Maven 3.9 runs clean 3.2.0,
+  resources 3.3.1, install and deploy 3.1.x and dependency 3.7.0; the Ubuntu runners' Maven 3.10.0 already
+  matches, except that it leaves the dependency plugin to the newest release. Resource output is
+  byte-identical under resources 3.3.1 and 3.5.0.
+- Build tooling: Gradle 9.8.2 in the shared `verify-signing-key-gradle` job, in step with the sibling
+  repositories.
 - Formal verification: OpenJML 21.0.28 (from 21.0.27; default solver z3 5.1.0). ESC 14/14 and RAC
   285/285 unchanged; the bundled-spec workarounds stay (the upstream fixes are not in 21.0.28).
 - **CI: shared files and the release gate are checked.** The files kept byte-identical with the sibling
diff --git a/pom.xml b/pom.xml
index 4dd8029..a676a45 100644
--- a/pom.xml
+++ b/pom.xml
@@ -339,6 +339,39 @@ SPDX-License-Identifier: Apache-2.0
                     <artifactId>central-publishing-maven-plugin</artifactId>
                     <version>0.12.0</version>
                 </plugin>
+                <!--
+                    Bound by the clean and default lifecycles (clean, resources, install, deploy) or invoked by prefix
+                    (mvn dependency:...) and configured nowhere else, so their versions came from whichever Maven ran the
+                    build: Maven 3.10.0 binds clean 3.5.0, resources 3.5.0, install 3.2.0 and deploy 3.2.0 and manages no
+                    dependency plugin (dependency:... then takes the newest release); Maven 3.9 binds clean 3.2.0, resources
+                    3.3.1, install and deploy 3.1.x and manages dependency 3.7.0. Stated here so the build does not depend on
+                    the Maven that runs it, and so check-versions.py compares them across the repositories.
+                -->
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-clean-plugin</artifactId>
+                    <version>3.5.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-resources-plugin</artifactId>
+                    <version>3.5.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-install-plugin</artifactId>
+                    <version>3.2.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-deploy-plugin</artifactId>
+                    <version>3.2.0</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-dependency-plugin</artifactId>
+                    <version>3.11.0</version>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>