diff --git a/.github/scripts/install-local-dependencies.sh b/.github/scripts/install-local-dependencies.sh
new file mode 100644
index 0000000..b816d9b
--- /dev/null
+++ b/.github/scripts/install-local-dependencies.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Run from the repository root after downloading the pinned JARs.
+# Hash-qualified versions prevent different private JARs sharing a Maven cache key.
+sha256sum --check .github/dependencies.sha256
+
+mvn -B --no-transfer-progress org.apache.maven.plugins:maven-install-plugin:3.1.4:install-file \
+    -Dfile="libs/gson-2.10.1.jar" -DgroupId="local" -DartifactId="gson" \
+    -Dversion="2.10.1-tfmc-4241c14a7727" -Dpackaging=jar -DgeneratePom=true "$@"
diff --git a/.github/scripts/prepare-release.sh b/.github/scripts/prepare-release.sh
index 1e21ec3..3e4c1d6 100644
--- a/.github/scripts/prepare-release.sh
+++ b/.github/scripts/prepare-release.sh
@@ -4,4 +4,4 @@ set -euo pipefail
 ref=883970ddc256f0e4c3bcaee87e6cf33171b9d4a4
 mkdir -p libs
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/4241c14a7727/gson-2.10.1.jar?ref=$ref" > "libs/gson-2.10.1.jar"
-sha256sum --check .github/dependencies.sha256
+bash .github/scripts/install-local-dependencies.sh "$@"
diff --git a/pom.xml b/pom.xml
index ad29516..0ff4edd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,9 +20,8 @@
         <dependency>
             <groupId>local</groupId>
             <artifactId>gson</artifactId>
-            <version>2.10.1</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/gson-2.10.1.jar</systemPath>
+            <version>2.10.1-tfmc-4241c14a7727</version>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>me.plugins</groupId>