diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4713d04..7e232a2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,10 +5,12 @@ name: CodeQL Scan
 on:
   pull_request:
     branches:
-      - "main"
+      - main
+      - spring-boot-3.5.x
   push:
     branches:
-      - "main"
+      - main
+      - spring-boot-3.5.x
   schedule:
     - cron: "0 3 * * MON" # Run Monday at 3AM UTC
 
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index bc9bc60..ebef234 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -5,6 +5,7 @@ on:
   pull_request:
     branches:
       - main
+      - spring-boot-3.5.x
 
 jobs:
   build:
diff --git a/build.gradle b/build.gradle
index dff0582..d8ccdc5 100644
--- a/build.gradle
+++ b/build.gradle
@@ -14,7 +14,7 @@ subprojects {
         mockitoVersion = '5.11.0'
         guavaVersion = '33.5.0-jre'
         lombokVersion = '1.18.36'
-        springBoot3Version = '3.5.7'
+        springBootVersion = '3.5.14'
         caffeineVersion = "3.2.3"
         slf4jVersion = '2.0.17'
         logback14xVersion = '1.5.18'
diff --git a/oidc-client-spring-boot/build.gradle b/oidc-client-spring-boot/build.gradle
index 0009b39..1854ff1 100644
--- a/oidc-client-spring-boot/build.gradle
+++ b/oidc-client-spring-boot/build.gradle
@@ -13,11 +13,16 @@ dependencies {
     api project(":oidc-client")
     api("com.auth0:auth0:${auth0JavaVersion}")
 
-    compileOnly("org.springframework.boot:spring-boot-starter-web:${springBoot3Version}")
+    compileOnly("org.springframework.boot:spring-boot-starter-web:${springBootVersion}")
 
     // Dependencies required to run tests
-    testImplementation("org.springframework.boot:spring-boot-starter-test:${springBoot3Version}")
-    testImplementation("org.springframework.boot:spring-boot-starter-web:${springBoot3Version}")
+    testImplementation("org.springframework.boot:spring-boot-starter-test:${springBootVersion}")
+    testImplementation("org.springframework.boot:spring-boot-starter-web:${springBootVersion}")
+
+    constraints {
+        compileOnly('org.apache.tomcat.embed:tomcat-embed-core:10.1.55') { because 'CVE-2026-41293' }
+        testImplementation('org.apache.tomcat.embed:tomcat-embed-core:10.1.55') { because 'CVE-2026-41293' }
+    }
 }
 
 spotbugs {