diff --git a/gradle.properties b/gradle.properties
new file mode 100644
index 0000000..7f62e10
--- /dev/null
+++ b/gradle.properties
@@ -0,0 +1,8 @@
+# CVE-2026-68525 / CVE-2026-65905 / CVE-2026-65182: Tomcat FORM auth bypass,
+# DIGEST replay, security constraint bypass. Spring Boot 3.5.16's BOM pins
+# 10.1.55; override the BOM property (dependency-management gives project
+# properties precedence). 10.1.58 was never published; 10.1.60 carries the fix.
+tomcat.version=10.1.60
+# CVE-2026-89425: jackson-core DoS via unbounded StringBuilder on malformed
+# tokens. Spring Boot 3.5.16's BOM pins 2.21.4; override to patched 2.21.7.
+jackson-bom.version=2.21.7
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index e5bf9ae..7361582 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -8,7 +8,7 @@ springdoc = "2.8.6"
 lombok = "1.18.38"
 mapstruct = "1.6.3"
 mapstruct-processor = "1.6.3"
-jackson = "2.18.3"
+jackson = "2.21.7"
 micrometer = "1.15.5"
 opentelemetry = "2.15.0"
 testcontainers = "1.21.4"
diff --git a/syncflow-api/build.gradle b/syncflow-api/build.gradle
index 74d2ff0..3179074 100644
--- a/syncflow-api/build.gradle
+++ b/syncflow-api/build.gradle
@@ -4,14 +4,8 @@ plugins {
     alias(libs.plugins.spring.dependency.management)
 }
 
-// GHSA-mhm7-754m-9p8w: jackson-databind @JsonView bypass. Spring Boot 3.5.16's
-// BOM pins jackson-bom 2.21.4 (vulnerable). Re-import the Jackson BOM at the
-// patched 2.21.5 AFTER Spring Boot's BOM so the later import wins.
-dependencyManagement {
-    imports {
-        mavenBom "com.fasterxml.jackson:jackson-bom:2.21.5"
-    }
-}
+// Jackson BOM version is overridden centrally via jackson-bom.version in
+// gradle.properties (covers GHSA-mhm7-754m-9p8w and CVE-2026-89425).
 
 dependencies {
     implementation project(":syncflow-core")