diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bd0e899c..2ed0b943 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -59,3 +59,20 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(actions)"
+
+  # Java binding + examples (Maven). Tracks the C-ABI binding's build plugins
+  # (e.g. central-publishing-maven-plugin) and the examples' jackson dependency,
+  # which had no Dependabot coverage before — a stale publishing plugin slipped
+  # through unnoticed until an OSV scan flagged it.
+  - package-ecosystem: maven
+    directories:
+      - "/bindings/java"
+      - "/bindings/java/benchmarks"
+      - "/examples/java"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(maven)"
diff --git a/bindings/java/pom.xml b/bindings/java/pom.xml
index 4ed1fe92..caf60a46 100644
--- a/bindings/java/pom.xml
+++ b/bindings/java/pom.xml
@@ -157,7 +157,7 @@
           <plugin>
             <groupId>org.sonatype.central</groupId>
             <artifactId>central-publishing-maven-plugin</artifactId>
-            <version>0.5.0</version>
+            <version>0.10.0</version>
             <extensions>true</extensions>
             <configuration>
               <publishingServerId>central</publishingServerId>
diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 00000000..0a4150ba
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,35 @@
+# OSV-Scanner suppressions (VEX record). Consumed by the OpenSSF Scorecard
+# Vulnerabilities check, which runs OSV-Scanner over this repository. Each entry
+# is an advisory assessed as not affecting Wickra; this mirrors the cargo-deny
+# `ignore` list in deny.toml at the OSV layer. See the "Vulnerability
+# exploitability (VEX)" section of SECURITY.md.
+
+# pyo3 — both advisories are fixed in pyo3 0.29.0, but rust-numpy 0.28 (latest
+# release) hard-pins pyo3 ^0.28.0, so the bump is upstream-blocked. Neither
+# vulnerable code path is reachable from the binding: it never calls
+# BoundListIterator nth/nth_back, the PyTuple equivalents, or
+# PyCFunction::new_closure (verified by grep over bindings/python/src). Also
+# tracked in deny.toml; remove once rust-numpy 0.29 ships and pyo3 is bumped.
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0176"
+reason = "pyo3 OOB read in PyList/PyTuple nth/nth_back; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-36hh-v3qg-5jq4"
+reason = "Alias of RUSTSEC-2026-0176."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0177"
+reason = "pyo3 missing Sync on PyCFunction::new_closure; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-chgr-c6px-7xpp"
+reason = "Alias of RUSTSEC-2026-0177."
+
+# jackson-core 3.x async-parser DoS — tools.jackson.core:jackson-core 3.x is not
+# a dependency of this project. No manifest, Maven plugin, or the GitHub
+# dependency-graph SBOM references jackson 3.x; the only jackson present is
+# com.fasterxml.jackson.core:jackson-databind 2.17.1 (examples only). Not affected.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency of this project; only jackson-databind 2.17.1 is present. Not affected."