diff --git a/.agents/skills/java-engineering-excellence/SKILL.md b/.agents/skills/java-engineering-excellence/SKILL.md
index 677cfe0bf..3881d1b87 100644
--- a/.agents/skills/java-engineering-excellence/SKILL.md
+++ b/.agents/skills/java-engineering-excellence/SKILL.md
@@ -84,7 +84,7 @@ ts-java-spring-boot-realworld/
 | `org.mybatis.spring.boot:mybatis-spring-boot-starter` | 2.2.2 | 3.0.x |
 | `io.jsonwebtoken:jjwt-api` | 0.11.2 | 0.12.x |
 | `joda-time:joda-time` | 2.10.13 | remove → `java.time` |
-| `org.xerial:sqlite-jdbc` | 3.36.0.3 | 3.45.x+ |
+| `org.xerial:sqlite-jdbc` | 3.53.2.0 | up to date (Java 8+ bytecode, runs on 11 and 21) |
 | `io.rest-assured:spring-mock-mvc` (test) | 4.5.1 | 5.4.x |
 | `com.diffplug.spotless` | 6.2.1 | 6.25.x |
 | `org.flywaydb:flyway-core` | (managed) | 10.x (Boot 3.5 managed) |
@@ -213,7 +213,7 @@ workflow (`.github/workflows/dependency-check.yml`) that:
 # - Spring Framework 5.3.15 (CVE-2022-22965 — Spring4Shell)
 # - jackson-databind 2.13.x (multiple RCE vectors)
 # - joda-time (EOL, no security patches)
-# - sqlite-jdbc 3.36.x (buffer overflow CVEs)
+# - sqlite-jdbc 3.36.x (buffer overflow CVEs) — remediated, now 3.53.2.0
 ```
 
 ### Automation Flow
diff --git a/build.gradle b/build.gradle
index 03c56f755..62334753e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -67,7 +67,7 @@ dependencies {
     runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.2',
                 'io.jsonwebtoken:jjwt-jackson:0.11.2'
     implementation 'joda-time:joda-time:2.10.13'
-    implementation 'org.xerial:sqlite-jdbc:3.36.0.3'
+    implementation 'org.xerial:sqlite-jdbc:3.53.2.0'
 
     compileOnly 'org.projectlombok:lombok'
     annotationProcessor 'org.projectlombok:lombok'