diff --git a/.gitignore b/.gitignore
index fa4571b..1985e48 100644
--- a/.gitignore
+++ b/.gitignore
@@ -123,3 +123,6 @@ specs/
 /data
 /packages
 /specs
+
+# Spectant run log (written by the spec plugin hooks, local only)
+.spectant/
diff --git a/backend/smoke/docker-compose.smoke.yml b/backend/smoke/docker-compose.smoke.yml
index 6f85255..6e50974 100644
--- a/backend/smoke/docker-compose.smoke.yml
+++ b/backend/smoke/docker-compose.smoke.yml
@@ -16,7 +16,7 @@
 # `SMOKE_IMAGE` names.
 services:
   greenmail:
-    image: greenmail/standalone:2.1.9
+    image: greenmail/standalone:2.1.15
     environment:
       # One user, no SSL. The IMAP path under test is provider discovery and the search
       # terms, not TLS; TLS is tested against wiremock, where a self-signed certificate
@@ -31,7 +31,7 @@ services:
       - "${SMOKE_GREENMAIL_API_PORT:-18081}:8080"
 
   wiremock:
-    image: wiremock/wiremock:3.13.1
+    image: wiremock/wiremock:3.13.2
     command:
       - --global-response-templating
       - --https-port=8443
diff --git a/docker-compose.yml b/docker-compose.yml
index d5a81c4..5d48812 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -22,7 +22,7 @@ services:
     # floating on `pg18`. A floating tag swaps the extension binary under a live data
     # directory on the next `docker compose pull`, and that is a change nobody can see in a
     # diff. Bumping it is an edit here, together with the two lines below.
-    image: pgvector/pgvector:0.8.6-pg18
+    image: pgvector/pgvector:0.8.7-pg18
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-leadgen}
       POSTGRES_USER: ${POSTGRES_USER:-leadgen}
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 77cfae6..8fc7d38 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -1,5 +1,5 @@
 [versions]
-springBoot = "4.1.1"
+springBoot = "4.1.2"
 springDependencyManagement = "1.1.7"
 testcontainers = "2.0.5"
 # Pinned here rather than taken from the Boot BOM: Boot 4 no longer manages jsoup.