diff --git a/examples/atlassian-connect-forge-spring-boot-sample/pom.xml b/examples/atlassian-connect-forge-spring-boot-sample/pom.xml
index d79e780..171c3e0 100644
--- a/examples/atlassian-connect-forge-spring-boot-sample/pom.xml
+++ b/examples/atlassian-connect-forge-spring-boot-sample/pom.xml
@@ -33,7 +33,7 @@
         <!-- Override Spring Boot 3.5.14 default (10.1.54) to clear the Tomcat
              CVE batch Snyk reports against sample-core (HTTP/2 headers, Digest
              auth, WebDAV LOCK/PROPFIND, etc.); fixed in 10.1.55. -->
-        <tomcat.version>10.1.59</tomcat.version>
+        <tomcat.version>10.1.60</tomcat.version>
         <!-- frontend toolchain — frontend-maven-plugin downloads Node + npm into target/,
              so contributors do not need a system-wide install and CI is reproducible.
              Node 24.x is the current LTS (Krypton); npm 11.12.1 is what it bundles. -->
diff --git a/pom.xml b/pom.xml
index 8688660..955fd00 100644
--- a/pom.xml
+++ b/pom.xml
@@ -54,7 +54,7 @@
         <spring-security.version>6.5.11</spring-security.version>
         <!-- Override Spring Boot 3.5.14 default (10.1.54) — Dependabot flagged
              several Critical/High Tomcat CVEs fixed in 10.1.55. -->
-        <tomcat.version>10.1.59</tomcat.version>
+        <tomcat.version>10.1.60</tomcat.version>
         <error-prone.version>2.49.0</error-prone.version>
         <atlassian.connect.version>6.0.7</atlassian.connect.version>
         <maven-checkstyle-plugin.version>3.6.0</maven-checkstyle-plugin.version>