diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 5871edac..f11c92e5 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -9,7 +9,7 @@ repositories {
 
 
 dependencies {
-    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:2.3.21")
-    implementation("org.jetbrains.kotlin:kotlin-serialization:2.3.21")
+    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.21")
+    implementation("org.jetbrains.kotlin:kotlin-serialization:2.4.21")
     implementation("com.diffplug.spotless:spotless-plugin-gradle:8.2.0")
 }
\ No newline at end of file
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 65c596ef..9f61f9a9 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -6,12 +6,12 @@
   handlebars = 'com.github.jknack:handlebars:4.5.0'
   jetbrains-annotations = 'org.jetbrains:annotations:26.0.2-1'
   jspecify = 'org.jspecify:jspecify:1.0.0'
-  jwt = 'com.nimbusds:nimbus-jose-jwt:9.47'
+  jwt = 'com.nimbusds:nimbus-jose-jwt:10.10'
   mutiny = 'io.smallrye.reactive:mutiny:2.7.0'
   reactiverse-contextual-logging = 'io.reactiverse:reactiverse-contextual-logging:1.2.1'
   slf4j-nop = 'org.slf4j:slf4j-nop:2.0.16'
   testcontainers = 'org.testcontainers:testcontainers:1.21.4'
-  tink = 'com.google.crypto.tink:tink:1.18.0'
+  tink = 'com.google.crypto.tink:tink:1.23.0'
   tomcat-annotations = 'org.apache.tomcat:annotations-api:6.0.53'
   bytebuddy = "net.bytebuddy:byte-buddy:1.18.3"
   objenesis = "org.objenesis:objenesis:3.4"
@@ -302,9 +302,9 @@
   grpc = '1.70.0'
   jackson = '2.22.0'
   junit = '5.14.1'
-  kotlinx-coroutines = '1.10.2'
-  kotlinx-serialization = '1.9.0'
-  ksp = '2.3.0'
+  kotlinx-coroutines = '1.11.0'
+  kotlinx-serialization = '1.11.0'
+  ksp = '2.3.12'
   log4j = '2.24.3'
   micrometer = '1.14.14'
   micrometer-context-propagation = '1.1.3'
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index f8e1ee31..61285a65 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 19a6bdeb..1a31fd1b 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/sdk-core/build.gradle.kts b/sdk-core/build.gradle.kts
index f2d03eff..0764b9c3 100644
--- a/sdk-core/build.gradle.kts
+++ b/sdk-core/build.gradle.kts
@@ -1,3 +1,4 @@
+import com.google.devtools.ksp.gradle.KspAATask
 import org.gradle.kotlin.dsl.withType
 import org.jetbrains.dokka.gradle.tasks.DokkaGenerateTask
 import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
@@ -261,8 +262,8 @@ tasks
 // ===========================================================================
 // Code generation: protobuf, jsonSchema2Pojo, ksp
 //
-// Downstream consumers of the generated sources (compile/jar/dokka) are wired in the Compilation
-// section below.
+// Downstream consumers of the generated sources (compile/ksp/jar/dokka) are wired in the
+// Compilation section below.
 // ===========================================================================
 
 // Protobuf: the Restate wire protocol for the pure-Java state machine.
@@ -322,6 +323,9 @@ tasks {
     )
   }
   withType<KotlinCompile>().configureEach { dependsOn(*codegen) }
+  // KSP scans the main source dirs, which include the generated proto sources. Not the full
+  // `codegen`: generateJsonSchema2Pojo depends on processResources, which depends on kspKotlin.
+  withType<KspAATask>().configureEach { dependsOn("generateProto") }
   withType<org.gradle.jvm.tasks.Jar>().configureEach {
     // Multi-release jar so the FFM overlay under META-INF/versions/23 is honored on JDK >= 23.
     manifest { attributes("Multi-Release" to "true") }