diff --git a/pom.xml b/pom.xml
index e3742fa..70980d9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -108,6 +108,14 @@
 			<artifactId>smbj</artifactId>
 			<version>0.14.0</version>
 		</dependency>
+		<!-- Override the vulnerable version pulled transitively by smbj (GHSA-574f-3g2m-x479, GHSA-c3fc-8qff-9hwx);
+		     declared as a direct runtime dependency so downstream consumers get the fixed version too -->
+		<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcprov-jdk18on</artifactId>
+			<version>1.85</version>
+			<scope>runtime</scope>
+		</dependency>
 		<dependency>
 			<groupId>org.mockito</groupId>
 			<artifactId>mockito-inline</artifactId>