diff --git a/agents-kt-identity/build.gradle.kts b/agents-kt-identity/build.gradle.kts
index 35918c9..11b2e02 100644
--- a/agents-kt-identity/build.gradle.kts
+++ b/agents-kt-identity/build.gradle.kts
@@ -29,7 +29,7 @@ dependencies {
 
     // #4521 — vetted JOSE/JWS + JWKS library; badge verification is trust-critical, so we do not
     // hand-roll JWS signature verification (alg-confusion, ES256 P1363/DER, alg=none are real footguns).
-    api("com.nimbusds:nimbus-jose-jwt:10.3")
+    api("com.nimbusds:nimbus-jose-jwt:10.9.1")
 
     testImplementation(kotlin("test"))
     testImplementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.11.0")
diff --git a/agents-kt-identity/gradle.lockfile b/agents-kt-identity/gradle.lockfile
index 4c7de9a..85ef512 100644
--- a/agents-kt-identity/gradle.lockfile
+++ b/agents-kt-identity/gradle.lockfile
@@ -1,7 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-com.nimbusds:nimbus-jose-jwt:10.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.nimbusds:nimbus-jose-jwt:10.9.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.bouncycastle:bcprov-jdk18on:1.84=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlin:kotlin-build-tools-api:2.4.0=kotlinAbiValidationCompatClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 052691f..a8a72ce 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -520,6 +520,14 @@
             <sha256 value="df7a73ac02a9ebc4eee2144ba867e7ec6f323fd7eaae25061996f74285e25ebc" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.nimbusds" name="nimbus-jose-jwt" version="10.9.1">
+         <artifact name="nimbus-jose-jwt-10.9.1.jar">
+            <sha256 value="33152ea83ec50d22706fdaf3b07acbcd716f9a68edcabdd7c4d02843cbdcdcf6" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="nimbus-jose-jwt-10.9.1.pom">
+            <sha256 value="d729b6d5d9efcb6bf54e77a9513c54deb2f1a2d9e9aab5ff3ddffbc1cbf716aa" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.squareup.okio" name="okio" version="3.11.0">
          <artifact name="okio-3.11.0.module">
             <sha256 value="950058faacfc06a003c4f20152df854742279cb361e0427514d8c4e43740ddec" origin="Generated by Gradle"/>