diff --git a/controller/app/build.gradle b/controller/app/build.gradle
index 9786d4e02..334cd918e 100644
--- a/controller/app/build.gradle
+++ b/controller/app/build.gradle
@@ -237,6 +237,28 @@ android {
 }
 
 dependencies {
+    // Security (Snyk): raise vulnerable transitive versions. The app does not call these
+    // APIs directly, so this changes only the resolved version, not app behavior.
+    constraints {
+        implementation('org.bouncycastle:bcprov-jdk15to18:1.85') {
+            because 'Snyk CVE fixes; pulled transitively by libadb-android 3.1.1 (was 1.81).'
+        }
+        implementation('com.squareup.okio:okio:1.17.6') {
+            because 'Snyk CVE fix; transitive (was 1.17.5).'
+        }
+        implementation('org.jetbrains.kotlin:kotlin-stdlib:2.1.0') {
+            because 'Snyk CVE-2020-29582 (removes deprecated kotlin.io temp-file helpers); transitive via AndroidX (was 1.9.24). No Kotlin source in this module.'
+        }
+        // Keep the stdlib family in lockstep. jdk7/jdk8 are empty stubs since Kotlin
+        // 1.8, so this only prevents version drift; it changes no code.
+        implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0') {
+            because 'Align with kotlin-stdlib above.'
+        }
+        implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.1.0') {
+            because 'Align with kotlin-stdlib above.'
+        }
+    }
+
     // ADFA-4533: GlitchTip (Sentry-compatible) crash reporting SDK.
     implementation 'io.sentry:sentry-android-core:8.29.0'
 
diff --git a/controller/termux-core/build.gradle b/controller/termux-core/build.gradle
index 386954437..4ab2e0f6f 100644
--- a/controller/termux-core/build.gradle
+++ b/controller/termux-core/build.gradle
@@ -114,12 +114,28 @@ if (System.getProperty("os.arch") == "aarch64"
 }
 
 dependencies {
+    // Security (Snyk): raise the transitive Kotlin stdlib. This module has no Kotlin
+    // source; the stdlib arrives through AndroidX. Version-only, no behavior change.
+    constraints {
+        implementation('org.jetbrains.kotlin:kotlin-stdlib:2.1.0') {
+            because 'Snyk CVE-2020-29582 (removes deprecated kotlin.io temp-file helpers); transitive via AndroidX (was 1.8.22).'
+        }
+        // Keep the stdlib family in lockstep. jdk7/jdk8 are empty stubs since Kotlin
+        // 1.8, so this only prevents version drift; it changes no code.
+        implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0') {
+            because 'Align with kotlin-stdlib above.'
+        }
+        implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.1.0') {
+            because 'Align with kotlin-stdlib above.'
+        }
+    }
+
     implementation 'androidx.appcompat:appcompat:1.7.1'
     implementation 'com.google.android.material:material:1.13.0'
 
     // --- TERMUX PATCHES ---
     implementation 'com.google.guava:guava:31.1-jre'
-    implementation 'commons-io:commons-io:2.11.0'
+    implementation 'commons-io:commons-io:2.14.0'   // Snyk CVE fix (was 2.11.0)
 
     // Markdown
     implementation 'io.noties.markwon:core:4.6.2'