diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b8f90e4..d1efe00 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v2
 
       - name: Cache maven artifacts
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-${{ matrix.java }}-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9c8ed9c..7b57094 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@v2
 
       - name: Cache maven artifacts
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-${{ matrix.java }}-${{ hashFiles('**/pom.xml') }}
diff --git a/src/main/java/net/ripe/ipresource/Asn.java b/src/main/java/net/ripe/ipresource/Asn.java
index fa780fa..3d39fd0 100644
--- a/src/main/java/net/ripe/ipresource/Asn.java
+++ b/src/main/java/net/ripe/ipresource/Asn.java
@@ -54,8 +54,8 @@ public class Asn extends UniqueIpResource {
     // unsigned long value.
     private int intValue;
 
-    public Asn(BigInteger value) {
-        this(value.longValue());
+    public Asn(BigInteger value) {        
+        this(value.longValueExact());
     }
 
     public Asn(long value) {
diff --git a/src/main/java/net/ripe/ipresource/IpRange.java b/src/main/java/net/ripe/ipresource/IpRange.java
index 3c3387c..54e0d8e 100644
--- a/src/main/java/net/ripe/ipresource/IpRange.java
+++ b/src/main/java/net/ripe/ipresource/IpRange.java
@@ -48,8 +48,9 @@ public static IpRange range(IpAddress start, IpAddress end) {
 
     public static IpRange prefix(IpAddress networkNumber, int prefixLength) {
         Validate.notNull(networkNumber, "network number not null");
-        Validate.isTrue(prefixLength >= 0);
-        Validate.isTrue(prefixLength <= networkNumber.getType().getBitSize());
+        Validate.isTrue(prefixLength >= 0, "prefix length must be non-negative");
+        Validate.isTrue(prefixLength <= networkNumber.getType().getBitSize(), 
+            "prefix " + prefixLength + " out of bounds (maximum " + networkNumber.getType().getBitSize() + ")");
         return new IpRange(networkNumber, prefixLength);
     }
 
diff --git a/src/test/java/net/ripe/ipresource/AsnTest.java b/src/test/java/net/ripe/ipresource/AsnTest.java
index be180ae..7b5ef56 100644
--- a/src/test/java/net/ripe/ipresource/AsnTest.java
+++ b/src/test/java/net/ripe/ipresource/AsnTest.java
@@ -31,6 +31,8 @@
 
 import static org.junit.Assert.*;
 
+import java.math.BigInteger;
+
 import org.junit.Test;
 
 /**
@@ -80,6 +82,18 @@ public void shouldFailOnIllegalValue() {
         Asn.parse("AS232442321412");
     }
 
+    @Test(expected = IllegalArgumentException.class)
+    public void shouldFailOnVeryBigLong() {                
+        new Asn(1 << 63L);
+    }
+
+    @Test(expected = ArithmeticException.class)
+    public void shouldFailOnWraparoundBigInteger() {
+        // BigInteger.longValue() keeps only the low 64 bits, so converting this value with longValue()
+        // would wrap around to 5, which is in range. Asn(BigInteger) must reject it regardless.
+        new Asn(BigInteger.ONE.shiftLeft(64).add(BigInteger.valueOf(5)));
+    }
+
     @Test
     public void shouldParseDotNotatedAsNumber() {
         assertEquals(new Asn(65536), Asn.parse("AS1.0"));
diff --git a/src/test/java/net/ripe/ipresource/IpRangeTest.java b/src/test/java/net/ripe/ipresource/IpRangeTest.java
index 6f6c90c..be9fee8 100644
--- a/src/test/java/net/ripe/ipresource/IpRangeTest.java
+++ b/src/test/java/net/ripe/ipresource/IpRangeTest.java
@@ -131,4 +131,9 @@ public void shouldCheckPrefixLength_NonNegative() {
     public void shouldCheckPrefixLength_NotGreatherThanAddressBitSize() {
         IpRange.prefix(IpAddress.parse("127.0.0.0"), 34);
     }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void shouldCheckPrefixLength_NotGreatherThanAddressBitSize_v6() {
+        IpRange.prefix(IpAddress.parse("2001:67c:2e8:13:21e:c2ff:0:0"), 129);
+    }    
 }