diff --git a/pom.xml b/pom.xml
index 0aebcc6e..19085610 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,22 +55,22 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <!-- Force bouncycastle to 1.84 to fix CVE-2026-5598 (private key leakage via non-constant-time comparisons). -->
+            <!-- Force bouncycastle to 1.85 to fix CVE-2026-5598 (private key leakage via non-constant-time comparisons). -->
             <!-- Pulled in transitively via okta-jwt-verifier → sslcontext-kickstart-for-pem. -->
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcprov-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpkix-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcutil-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
         </dependencies>
     </dependencyManagement>