diff --git a/bom/pom.xml b/bom/pom.xml
index c462da8d1..5ca7eb06c 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -342,6 +342,10 @@
                         <groupId>io.dropwizard.metrics</groupId>
                         <artifactId>metrics-core</artifactId>
                     </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>*</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>
diff --git a/pom.xml b/pom.xml
index 2c201a03d..fe1023d69 100644
--- a/pom.xml
+++ b/pom.xml
@@ -43,7 +43,7 @@
     <properties>
         <!-- Primary dependencies -->
         <quarkus.version>3.17.5</quarkus.version>
-        <cxf.version>4.0.6</cxf.version>
+        <cxf.version>4.1.0</cxf.version>
         <quarkus-enforcer-rules.version>${quarkus.version}</quarkus-enforcer-rules.version>
         <quarkus-antora.version>1.0.1</quarkus-antora.version>
 
@@ -52,21 +52,21 @@
         <angus-mail.version>2.0.3</angus-mail.version>
         <assertj.version>3.27.0</assertj.version>
         <cryptacular.version>1.2.6</cryptacular.version><!-- 1.2.7 does not work - see https://github.com/quarkiverse/quarkus-cxf/issues/1648 -->
-        <cxf.xjcplugins.version>4.0.1</cxf.xjcplugins.version><!-- @sync org.apache.cxf:cxf:${cxf.version} prop:cxf.xjc-utils.version -->
+        <cxf.xjcplugins.version>4.1.0</cxf.xjcplugins.version><!-- @sync org.apache.cxf:cxf:${cxf.version} prop:cxf.xjc-utils.version -->
         <ehcache.version>3.10.8</ehcache.version>
         <fastinfoset.version>2.1.1</fastinfoset.version>
         <glassfish.jaxb.version>4.0.5</glassfish.jaxb.version><!-- @sync io.quarkus:quarkus-bom:${quarkus.version} dep:org.glassfish.jaxb:jaxb-runtime -->
         <jakarta.mail-api.version>2.1.3</jakarta.mail-api.version><!-- @sync org.eclipse.angus:all:${angus-mail.version} prop:mail-api.version -->
         <jakarta.jws-api.version>3.0.0</jakarta.jws-api.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.jakarta.jwsapi.version -->
-        <jakarta.xml.soap-api.version>2.0.1</jakarta.xml.soap-api.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.jakarta.soapapi.version -->
-        <jakarta.xml.ws-api.version>3.0.1</jakarta.xml.ws-api.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.jakarta.wsapi.version -->
+        <jakarta.xml.soap-api.version>3.0.2</jakarta.xml.soap-api.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.jakarta.soapapi.version -->
+        <jakarta.xml.ws-api.version>4.0.2</jakarta.xml.ws-api.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.jakarta.wsapi.version -->
         <jasypt.version>1.9.3</jasypt.version><!-- @sync org.apache.wss4j:wss4j-parent:${wss4j.version} prop:jasypt.version -->
         <httpclient5.version>5.4.1</httpclient5.version>
         <httpcore5.version>5.3.1</httpcore5.version>
         <neethi.version>3.2.1</neethi.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.neethi.version -->
         <mimepull.version>1.10.0</mimepull.version>
-        <saaj-impl.version>2.0.1</saaj-impl.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.saaj-impl.version -->
-        <santuario-xmlsec.version>3.0.5</santuario-xmlsec.version>
+        <saaj-impl.version>3.0.4</saaj-impl.version><!-- @sync org.apache.cxf:cxf-parent:${cxf.version} prop:cxf.saaj-impl.version -->
+        <santuario-xmlsec.version>4.0.3</santuario-xmlsec.version>
 
         <slf4j.version>2.0.6</slf4j.version><!-- @sync io.quarkus:quarkus-bom:${quarkus.version} dep:org.slf4j:slf4j-api -->
         <smallrye-certificate-generator.version>0.8.1</smallrye-certificate-generator.version><!-- @sync io.quarkus:quarkus-bom:${quarkus.version} dep:io.smallrye.certs:smallrye-certificate-generator -->