diff --git a/Dockerfile b/Dockerfile
index fa52d09bf..48938bfbf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@ FROM eclipse-temurin:25@sha256:3ab7fc8d0b4ade8fef96903fb36767c1dbb4fd1535dcfad85
 
 # ca-certificates is listed so that the base image's copy is upgraded to the
 # latest Ubuntu release, which carries CA distrusts such as the eMudhra one.
-RUN apt-get update && apt-get install --yes ca-certificates jq wget curl zip unzip git python3 python3-pip autoconf automake libtool build-essential libtool make g++
+RUN apt-get update && apt-get upgrade --yes && apt-get install --yes ca-certificates jq wget curl zip unzip git python3 python3-pip autoconf automake libtool build-essential libtool make g++ && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /workdir
 
@@ -12,7 +12,6 @@ RUN ./docker-setup.sh
 
 ENV PATH=/opt/maven/bin:${PATH}
 ENV PATH=/opt/gradle/bin:${PATH}
-ENV PATH=/root/.local/share/coursier/bin:${PATH}
 
 # The trust store is generated by docker-setup.sh. Setting it here also covers
 # JDKs that coursier downloads at runtime, e.g. for `"jvm": "11"`.
@@ -21,7 +20,7 @@ RUN git config --global --add safe.directory *
 
 COPY . .
 
-RUN gradle --no-daemon :scip-java:installDist && mkdir -p /app/scip-java && cp -R scip-java/build/install/scip-java/. /app/scip-java/
+RUN gradle --no-daemon :scip-java:installDist && mkdir -p /app/scip-java && cp -R scip-java/build/install/scip-java/. /app/scip-java/ && rm -rf /root/.gradle
 
 COPY ./bin/scip-java-docker-script.sh /usr/bin/scip-java
 
diff --git a/bin/docker-setup.sh b/bin/docker-setup.sh
index 11757f553..b5707e7f3 100755
--- a/bin/docker-setup.sh
+++ b/bin/docker-setup.sh
@@ -1,18 +1,16 @@
 #!/usr/bin/env bash
 set -eux
-curl -fLo /usr/local/bin/cs https://github.com/coursier/coursier/releases/download/v2.1.5/coursier
+# Use the upstream JVM launcher so the configured system trust store applies.
+curl -fLo /usr/local/bin/cs https://github.com/coursier/coursier/releases/download/v2.1.26/coursier
 chmod +x /usr/local/bin/cs
 ln -sf /usr/local/bin/cs /usr/local/bin/coursier
-# Only install the JVM launcher. The native `cs` app embeds the trust store of
-# the GraalVM it was built with, so it ignores the trust store set up below.
-cs setup --yes --apps coursier
 
-curl -fLo maven.zip https://archive.apache.org/dist/maven/maven-3/3.9.1/binaries/apache-maven-3.9.1-bin.zip 
+curl -fLo maven.zip https://archive.apache.org/dist/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.zip
 unzip -d /opt/maven maven.zip
 rm maven.zip
 mv /opt/maven/*/* /opt/maven
 
-curl -fLo gradle.zip https://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+curl -fLo gradle.zip https://services.gradle.org/distributions/gradle-9.8.2-bin.zip
 unzip -d /opt/gradle gradle.zip 
 rm gradle.zip
 mv /opt/gradle/*/* /opt/gradle
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index d5196d3f0..8c3e3a5f2 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -1,6 +1,7 @@
 [versions]
 clikt = "5.1.0"
 gradle-api = "8.11.1"
+guava = "33.7.2-jre"
 junit-jupiter = "5.11.4"
 kctfork = "0.14.0"
 kotest = "6.2.6"
@@ -21,6 +22,7 @@ vanniktech-maven-publish = "0.37.0"
 clikt-jvm = { module = "com.github.ajalt.clikt:clikt-jvm", version.ref = "clikt" }
 gradle-api = { module = "dev.gradleplugins:gradle-api", version.ref = "gradle-api" }
 gradle-test-kit = { module = "dev.gradleplugins:gradle-test-kit", version.ref = "gradle-api" }
+guava = { module = "com.google.guava:guava", version.ref = "guava" }
 kctfork-core = { module = "dev.zacsweers.kctfork:core", version.ref = "kctfork" }
 kotest-assertions-core = { module = "io.kotest:kotest-assertions-core-jvm", version.ref = "kotest" }
 kotlin-compiler-embeddable = { module = "org.jetbrains.kotlin:kotlin-compiler-embeddable", version.ref = "kotlin" }
diff --git a/scip-shared/build.gradle.kts b/scip-shared/build.gradle.kts
index f046f5572..2b35f30cb 100644
--- a/scip-shared/build.gradle.kts
+++ b/scip-shared/build.gradle.kts
@@ -7,4 +7,9 @@ description = "Shared SCIP utilities used by scip-java compiler plugins"
 
 dependencies {
     api(libs.scip.java.bindings)
+    constraints {
+        api(libs.guava) {
+            because("CVE-2026-102554")
+        }
+    }
 }