diff --git a/dependency-suppression.xml b/dependency-suppression.xml
index 74c8146..830c6a4 100644
--- a/dependency-suppression.xml
+++ b/dependency-suppression.xml
@@ -153,4 +153,27 @@
         <sha1>cdf7daa908a6601377172e09385eb43425fa9660</sha1>
         <cve>CVE-2026-66299</cve>
     </suppress>
+    <suppress until="2027-02-28Z">
+        <notes><![CDATA[
+        CVE-2026-54285 is a vulnerability in opentelemetry-js (the @opentelemetry/core npm
+        package), not in the Java client. NVD lists it as
+        cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:node.js:*:* — target_sw is node.js.
+        Dependency-Check derives cpe:2.3:a:opentelemetry:opentelemetry:<version> for the Java
+        jars with no target_sw, and the wildcard matches node.js, so every io.opentelemetry
+        Maven artifact below 2.8.0 matches. This project ships no Node OpenTelemetry.
+
+        This cannot be cleared by upgrading. The Java API is on the 1.x line and the CPE range
+        is "up to (excluding) 2.8.0", so every current and foreseeable Java release matches.
+
+        packageUrl is used instead of sha1 so the entry survives an opentelemetry.version bump.
+        The <cve> element pins it to this one CVE, so no other io.opentelemetry finding is masked.
+
+        Expires 2027-02-28. On that date the finding returns and the nightly PR is labelled
+        "security" and left unmerged. Re-check whether NVD has corrected the CPE to enforce
+        target_sw; if it has, delete this entry, otherwise extend the date.
+        Added: 2026-08-28
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry/.*$</packageUrl>
+        <cve>CVE-2026-54285</cve>
+    </suppress>
 </suppressions>
diff --git a/pom.xml b/pom.xml
index a51c5a3..17232fc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -71,8 +71,8 @@
         <nimbus-jose-jwt.version>10.9.1</nimbus-jose-jwt.version>
         <io-jsonwebtoken.version>0.13.0</io-jsonwebtoken.version>
         <mysql.version>9.7.0</mysql.version>
-        <aws-sdk.version>2.54.5</aws-sdk.version>
-        <camel.version>4.18.3</camel.version>
+        <aws-sdk.version>2.54.6</aws-sdk.version>
+        <camel.version>4.18.4</camel.version>
         <lombok.version>1.18.46</lombok.version>
         <!-- Bouncy Castle FIPS — versions managed manually; excluded from automated updates -->
         <bc-fips.version>2.1.3</bc-fips.version>
@@ -563,8 +563,13 @@
                 <artifactId>camel-core</artifactId>
                 <version>${camel.version}</version>
             </dependency>
+            <!-- camel-spring-boot-starter lives under groupId org.apache.camel.springboot
+                 (the camel-spring-boot repo), not org.apache.camel. The org.apache.camel
+                 coordinate exists on Central but stops at 3.0.0-RC3, so versions-maven-plugin
+                 could find no acceptable newer version for ${camel.version} and left the
+                 property frozen. Do not "simplify" the groupId back. -->
             <dependency>
-                <groupId>org.apache.camel</groupId>
+                <groupId>org.apache.camel.springboot</groupId>
                 <artifactId>camel-spring-boot-starter</artifactId>
                 <version>${camel.version}</version>
             </dependency>
diff --git a/validation/pom.xml b/validation/pom.xml
index 703bb09..0d5a21c 100644
--- a/validation/pom.xml
+++ b/validation/pom.xml
@@ -222,6 +222,11 @@
       <groupId>org.apache.camel</groupId>
       <artifactId>camel-core</artifactId>
     </dependency>
+    <!-- camel.version -->
+    <dependency>
+      <groupId>org.apache.camel.springboot</groupId>
+      <artifactId>camel-spring-boot-starter</artifactId>
+    </dependency>
     <!-- lombok.version -->
     <dependency>
       <groupId>org.projectlombok</groupId>
diff --git a/versions-rules.xml b/versions-rules.xml
index 10b9a13..1e6c957 100644
--- a/versions-rules.xml
+++ b/versions-rules.xml
@@ -32,6 +32,25 @@
                 <ignoreVersion type="regex">(?i).*[-.]cr\d*$</ignoreVersion>
             </ignoreVersions>
         </rule>
+        <!--
+          Apache Camel: stay within the 4.18.x LTS line.
+          Camel 4.19.0 and later are built against Spring Boot 4.x / Spring Framework 7
+          (4.19.0 and 4.20.0 -> Spring Boot 4.0.x; 4.21.0 and 4.22.0 -> Spring Boot 4.1.x).
+          This BOM pins spring-boot.version on the 3.5.x line, so an automated bump past
+          4.18.x would pull Spring Boot 4 into izgw-transform.
+          Remove this rule when the stack moves to Spring Boot 4.
+        -->
+        <rule groupId="org.apache.camel" artifactId="*">
+            <ignoreVersions>
+                <ignoreVersion type="regex">^(?!4\.18\.).*$</ignoreVersion>
+            </ignoreVersions>
+        </rule>
+        <rule groupId="org.apache.camel.springboot" artifactId="*">
+            <ignoreVersions>
+                <ignoreVersion type="regex">^(?!4\.18\.).*$</ignoreVersion>
+            </ignoreVersions>
+        </rule>
+
         <!--
           Apache Maven itself: stay within the 3.9.x line.
           The CI/CD pipeline is pinned to 3.9.14; do not suggest 4.x.