diff --git a/PUBLISHING.md b/PUBLISHING.md
index 79660e9..0714950 100644
--- a/PUBLISHING.md
+++ b/PUBLISHING.md
@@ -2,7 +2,7 @@
 
 Version is `0.1.0`. The reactor publishes five coordinates under `com.quantipixels.ogiri`: `ogiri-parent` and `ogiri-bom` (POMs), plus `ogiri`, `ogiri-spring-boot-autoconfigure`, and `ogiri-spring-boot-starter` (binary, sources and Javadoc JARs with POMs). The dependency-only starter's source/Javadoc attachments contain an explanatory README. The standalone BOM aligns only the three Ogiri libraries, without importing the build parent's dependency management.
 
-Supported runtime: Spring Boot 4.x, Java 17+, Jackson 3; current dependency baseline is Boot 4.1.1/Jackson 3.1.7. Build tools require Java 21+; the gate selects JDK 25. Boot 3/Jackson 2 are unsupported.
+Supported runtime: Spring Boot 4.x, Java 17+, Jackson 3; current dependency baseline is Boot 4.1.2/Jackson 3.2.4. Build tools require Java 21+; the gate selects JDK 25. Boot 3/Jackson 2 are unsupported.
 
 ## Local unsigned rehearsal
 
diff --git a/README.md b/README.md
index 6891564..658632b 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Ogiri adds database-backed opaque sessions and devise_token_auth (DTA) account endpoints to a Spring Boot application. Existing DTA frontends keep working. Every authenticated request checks the stored session and the current account. Your application keeps its account model and authorization rules.
 
-Requirements: Spring Boot 4.x (built against 4.1.1), Java 17+, Jackson 3, PostgreSQL or MySQL 8.4 (InnoDB). Boot 3 and Jackson 2 are unsupported. Version `0.1.0` is an unpublished prototype; before 1.0, API and schema changes can break compatibility (see the [changelog](CHANGELOG.md)).
+Requirements: Spring Boot 4.x (built against 4.1.2), Java 17+, Jackson 3, PostgreSQL or MySQL 8.4 (InnoDB). Boot 3 and Jackson 2 are unsupported. Version `0.1.0` is an unpublished prototype; before 1.0, API and schema changes can break compatibility (see the [changelog](CHANGELOG.md)).
 
 Coding agents: use the [ogiri-integration skill](skills/ogiri-integration/SKILL.md) to add Ogiri to an app, and [auth-design](skills/auth-design/SKILL.md) to plan auth first.
 
@@ -16,11 +16,11 @@ mise exec -- bash scripts/platform/java.sh sample
 
 This stages the artifacts in `target/java/consumer-cache` and writes `target/java/consumer-settings.xml`; pass that file with `mvn -s` from your application. It needs no database and does not touch your shared Maven cache.
 
-In your application's POM (with `spring-boot-starter-parent` 4.1.1):
+In your application's POM (with `spring-boot-starter-parent` 4.1.2):
 
 ```xml
 <properties>
-  <jackson-bom.version>3.1.7</jackson-bom.version>
+  <jackson-bom.version>3.2.4</jackson-bom.version>
   <tomcat.version>11.0.27</tomcat.version>
 </properties>
 <dependencyManagement>
@@ -47,7 +47,7 @@ In your application's POM (with `spring-boot-starter-parent` 4.1.1):
 </dependencies>
 ```
 
-For MySQL use `com.mysql:mysql-connector-j`. The Jackson and Tomcat overrides pick up security fixes missing from Boot 4.1.1's defaults. The BOM aligns only Ogiri artifacts.
+For MySQL use `com.mysql:mysql-connector-j`. The Jackson override matches the Jackson version Ogiri is built against; the Tomcat pin matches Boot 4.1.2's default and keeps older Boot 4.1.x releases on a patched Tomcat. The BOM aligns only Ogiri artifacts.
 
 ## 2. Create the tables
 
diff --git a/examples/spring-app/pom.xml b/examples/spring-app/pom.xml
index 5374c5d..a85ecfa 100644
--- a/examples/spring-app/pom.xml
+++ b/examples/spring-app/pom.xml
@@ -1,9 +1,9 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
-  <parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>4.1.1</version><relativePath/></parent>
+  <parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>4.1.2</version><relativePath/></parent>
   <groupId>com.quantipixels.ogiri.examples</groupId><artifactId>spring-app</artifactId><version>0.1.0</version>
-  <properties><java.version>17</java.version><tomcat.version>11.0.27</tomcat.version><jackson-bom.version>3.1.7</jackson-bom.version></properties>
-  <!-- Boot 4.1.1 ships Tomcat 11.0.24 and Jackson 3.1.5, both with known advisories; keep Ogiri's patched 11.0.27 and 3.1.7 baseline. -->
+  <properties><java.version>17</java.version><tomcat.version>11.0.27</tomcat.version><jackson-bom.version>3.2.4</jackson-bom.version></properties>
+  <!-- Match Ogiri's build baseline: Tomcat 11.0.27 (Boot 4.1.2's default) and Jackson 3.2.4. -->
   <dependencyManagement><dependencies>
     <dependency><groupId>com.quantipixels.ogiri</groupId><artifactId>ogiri-bom</artifactId><version>0.1.0</version><type>pom</type><scope>import</scope></dependency>
   </dependencies></dependencyManagement>
diff --git a/pom.xml b/pom.xml
index 7ec4317..fd3cb73 100644
--- a/pom.xml
+++ b/pom.xml
@@ -16,14 +16,14 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.build.outputTimestamp>2026-09-07T00:00:00Z</project.build.outputTimestamp>
     <!-- Runtime compatibility: Spring Boot 4.x, Java 17+, Jackson 3. Build tools require Java 21+. -->
-    <spring-boot.version>4.1.1</spring-boot.version>
-    <jackson.version>3.1.7</jackson.version><ogiri.test.jvm>${java.home}/bin/java</ogiri.test.jvm>
+    <spring-boot.version>4.1.2</spring-boot.version>
+    <jackson.version>3.2.4</jackson.version><ogiri.test.jvm>${java.home}/bin/java</ogiri.test.jvm>
     <tomcat.version>11.0.27</tomcat.version>
     <postgresql.version>42.7.13</postgresql.version>
   </properties>
   <dependencyManagement><dependencies>
     <dependency><groupId>tools.jackson</groupId><artifactId>jackson-bom</artifactId><version>${jackson.version}</version><type>pom</type><scope>import</scope></dependency>
-    <!-- Boot 4.1.1 predates the fixes for CVE-2026-65905, CVE-2026-65182 and CVE-2026-68525. -->
+    <!-- Boot 4.1.2 ships this Tomcat; the explicit pin keeps the fixes for CVE-2026-65905, CVE-2026-65182 and CVE-2026-68525 if the Boot import changes. -->
     <dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>${tomcat.version}</version></dependency>
     <dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-el</artifactId><version>${tomcat.version}</version></dependency>
     <dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-websocket</artifactId><version>${tomcat.version}</version></dependency>