diff --git a/.github/workflows/security-secrets-scan.yml b/.github/workflows/security-secrets-scan.yml
index 9b2da08..f85e998 100644
--- a/.github/workflows/security-secrets-scan.yml
+++ b/.github/workflows/security-secrets-scan.yml
@@ -32,8 +32,13 @@ jobs:
         with:
           fetch-depth: 0
 
+      # The gitleaks GitHub Action (gitleaks/gitleaks-action@v2) requires a paid
+      # license for organization-owned repos. The gitleaks CLI itself is MIT and
+      # free, so we run the pinned binary directly to scan full git history.
       - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz gitleaks
+          ./gitleaks git . --config .gitleaks.toml --redact --verbose --exit-code 1
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..fb5dbd0
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,16 @@
+# Gitleaks configuration for NULVEX — extends the built-in ruleset.
+title = "NULVEX gitleaks config"
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = """
+Non-secret format-label constants. These are algorithm identifiers stored as
+JSON "format" field values (not credentials); the generic-api-key rule trips on
+the variable name containing KEY plus the string entropy.
+"""
+regexTarget = "match"
+regexes = [
+  '''xchacha20poly1305_key''',
+]
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 5e2bdab..19390b1 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -9,16 +9,16 @@ testCore = "1.7.0"
 lifecycleRuntimeKtx = "2.11.0"
 activityCompose = "1.13.0"
 kotlin = "2.3.21"
-composeBom = "2026.06.01"
+composeBom = "2026.08.00"
 room = "2.8.4"
 sqlite = "2.7.0"
 sqlcipher = "4.17.0"
 argon2kt = "1.6.0"
 tink = "1.23.0"
 work = "2.11.2"
-ksp = "2.3.10"
+ksp = "2.3.11"
 biometric = "1.1.0"
-appcompat = "1.7.1"
+appcompat = "1.8.0"
 playServicesAds = "25.4.0"
 playServicesCodeScanner = "16.1.0"
 playIntegrity = "1.6.0"
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index dbe66e1..84c5a9c 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
+distributionSha256Sum=84fbba45c7f4c64abc77460e1c00f541e9f960e3c7ed2538f1ede19eacd873ae
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.0-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500