diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c18e7c0..5905ed8 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/CLAUDE.md b/CLAUDE.md
index 19e1fb1..98f5646 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -355,7 +355,7 @@ assume it has already been updated.
 |---|---|---|
 | `net.ladenthin:llama` | 5.0.6 | `srcmorph` (`provider` package only) — llama.cpp JNI binding |
 | `org.slf4j:slf4j-api` | 2.0.18 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin |
-| `ch.qos.logback:logback-classic` | 1.5.38 (converged in the parent) | `srcmorph-cli` (runtime binding) |
+| `ch.qos.logback:logback-classic` | 1.6.0 (converged in the parent) | `srcmorph-cli` (runtime binding) |
 | `com.fasterxml.jackson.core:jackson-databind` | pinned in parent | `srcmorph-cli` (JSON config) |
 | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` | pinned in parent | `srcmorph-cli` (YAML config) |
 | `org.apache.maven:maven-plugin-api` | 3.9.16 | `srcmorph-maven-plugin` (provided) |
diff --git a/pom.xml b/pom.xml
index e40c9ef..1f10989 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,14 +99,16 @@ SPDX-License-Identifier: Apache-2.0
                 <version>2.0.18</version>
             </dependency>
             <!--
-                Pin the version the llama dependency already brings in transitively (runtime scope),
-                so an explicit test-scope declaration (used to attach a ListAppender in
-                AiFieldGenerationSupportTest) stays converged with it.
+                Pin logback-classic (runtime scope) so the runtime binding and the explicit
+                test-scope declaration (used to attach a ListAppender in
+                AiFieldGenerationSupportTest) stay converged. The managed version here wins over
+                whatever the llama dependency brings in transitively, satisfying maven-enforcer's
+                DependencyConvergence.
             -->
             <dependency>
                 <groupId>ch.qos.logback</groupId>
                 <artifactId>logback-classic</artifactId>
-                <version>1.5.38</version>
+                <version>1.6.0</version>
             </dependency>
             <!--
                 JSON/YAML binding for srcmorph-cli's CConfiguration. Both artifacts are pinned to the
diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml
index c4495db..ee8026a 100644
--- a/srcmorph-cli/pom.xml
+++ b/srcmorph-cli/pom.xml
@@ -185,7 +185,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml
index b1b0f00..7e09619 100644
--- a/srcmorph-maven-plugin/pom.xml
+++ b/srcmorph-maven-plugin/pom.xml
@@ -255,7 +255,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index ba5a619..c4d6b70 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -189,7 +189,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>