diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index aa4f890..66db813 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -162,7 +162,7 @@ jobs:
   # SECURITY: prints no secret material. Key/passphrase reach Gradle only via env
   # (read by System.getenv at runtime); `set -x` is never enabled; the passphrase
   # is `::add-mask::`ed; Gradle runs with `--stacktrace` only. Only the produced
-  # `.asc` (exit code) is asserted. Uses Gradle 8.14.3.
+  # `.asc` (exit code) is asserted. Uses Gradle 9.6.1.
   # ---------------------------------------------------------------------------
   verify-signing-key-gradle:
     name: Verify GPG signing key — Gradle/BouncyCastle path (no secrets printed)
@@ -176,7 +176,7 @@ jobs:
           distribution: temurin
       - uses: gradle/actions/setup-gradle@v6
         with:
-          gradle-version: "8.14.3"
+          gradle-version: "9.6.1"
       - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
         shell: bash
         env: