diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 03df5cf0..f1d4e099 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3356,7 +3356,7 @@ jobs:
       - uses: actions/download-artifact@v8
         with: { name: jacoco-report, path: target/site/jacoco/ }
         continue-on-error: true
-      - uses: advanced-security/maven-dependency-submission-action@v5
+      - uses: advanced-security/maven-dependency-submission-action@v6
       - name: Coveralls
         uses: coverallsapp/github-action@v2
         with:
diff --git a/llama-kotlin/pom.xml b/llama-kotlin/pom.xml
index d89b0c13..96fa1b35 100644
--- a/llama-kotlin/pom.xml
+++ b/llama-kotlin/pom.xml
@@ -60,7 +60,7 @@ SPDX-License-Identifier: MIT
 		<!-- Kotlin consumers can read metadata at most one minor version ahead of
 		     their own compiler, so compiling with Kotlin 2.4 keeps this artifact
 		     consumable from Kotlin 2.3+ projects (typical Android Studio installs). -->
-		<kotlin.version>2.4.10</kotlin.version>
+		<kotlin.version>2.4.20</kotlin.version>
 		<kotlinx.coroutines.version>1.11.0</kotlinx.coroutines.version>
 		<junit.version>6.1.3</junit.version>
 		<hamcrest.version>3.0</hamcrest.version>