diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a90fc86..a6c1272 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,7 +5,7 @@
 # 512m to force soft-reference eviction).
 #
 # Gradle is pinned by the committed wrapper (gradle/wrapper/gradle-wrapper.properties,
-# 8.14.5) and invoked via ./gradlew; setup-gradle only provides dependency caching.
+# 8.14.6) and invoked via ./gradlew; setup-gradle only provides dependency caching.
 
 name: CI
 
diff --git a/build.gradle b/build.gradle
index d325e94..63585be 100644
--- a/build.gradle
+++ b/build.gradle
@@ -178,7 +178,7 @@ dependencies {
     implementation 'org.junit.jupiter:junit-jupiter'
     implementation 'org.junit.platform:junit-platform-launcher'
     // Bytecode guardrail (promotion gate 2) — static scan of the compiled output.
-    implementation 'org.ow2.asm:asm:9.10.1'
+    implementation 'org.ow2.asm:asm:9.11.1'
     // Optional strict-schema validation of MCP tool I/O (protean.mcp.strict-schema=true). compileOnly, so it is NOT
     // shipped to consumers: the core stays zero-dep and falls back to the built-in top-level guard when the validator
     // is absent. A consumer that opts into strict mode (e.g. to validate their own custom tools) adds it themselves.
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index 1b33c55..02f06ab 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 4f5eb9d..d3f0219 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.6-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME