diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a6a31dd3fd..b5671c3f0f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -230,7 +230,7 @@ jobs:
       # well over a gigabyte on every run. Keyed on the version catalog so a Kotlin bump
       # re-populates it.
       - name: Cache Kotlin/Native toolchain
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.konan
           key: konan-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml') }}
diff --git a/commons/build.gradle.kts b/commons/build.gradle.kts
index e9b2fe321c..50437bf088 100644
--- a/commons/build.gradle.kts
+++ b/commons/build.gradle.kts
@@ -8,13 +8,13 @@ import org.jetbrains.kotlin.gradle.plugin.mpp.TestExecutable
 // Disables the Kotlin/Native compiler cache for an iOS test binary so the
 // Compose ui-uikit klib recompiles fresh instead of linking the broken prebuilt
 // cache (see the call site in the `kotlin {}` block). The version guard makes
-// Kotlin re-surface this workaround once we move past 2.4.10, so it can be
+// Kotlin re-surface this workaround once we move past 2.4.20, so it can be
 // dropped when a newer Compose/Kotlin pairing fixes the cache. Wrapped in a
 // helper because @OptIn only applies to declarations, not bare statements.
 @OptIn(KotlinNativeCacheApi::class)
 fun TestExecutable.disableUiKitPrebuiltCache() =
     disableNativeCache(
-        DisableCacheInKotlinVersion.`2_4_10`,
+        DisableCacheInKotlinVersion.`2_4_20`,
         "Compose ui-uikit prebuilt cache references UIViewLayoutRegion (iOS 17+); " +
             "linking the iOS test binary fails under Xcode 16.4.",
     )
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 538c9858bd..6d7757baf2 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -5,8 +5,13 @@
 app = "1.14.0"
 appCode = "457"
 accompanistAdaptive = "0.37.3"
+# Pinned: 0.3.0 turns CacheMap.entries/keys/values into DeprecationLevel.ERROR (and
+# throws UnsupportedOperationException at runtime), which breaks quartz's appleMain
+# LargeCache/ConcurrentHashCache — they read those views directly and through the
+# stdlib Map operators (filter/map/groupBy/associate/count). Bumping needs a port to
+# the new forEach/forEachKey/forEachValue API, verified on an Apple target.
 cachemapVersion = "0.2.4"
-composeMultiplatform = "1.11.1"
+composeMultiplatform = "1.12.0"
 activityCompose = "1.13.0"
 agp = "9.4.0"
 android-compileSdk = "37"
@@ -15,17 +20,17 @@ android-targetSdk = "37"
 androidxJunit = "1.3.0"
 appcompat = "1.8.0"
 audiowaveform = "1.1.2"
-benchmark = "1.5.0-rc01"
+benchmark = "1.5.0"
 uiautomator = "2.4.0"
 biometricKtx = "1.4.0-alpha02"
-coil = "3.5.0"
-composeBom = "2026.08.00"
-composeRuntimeAnnotation = "1.12.0"
+coil = "3.6.2"
+composeBom = "2026.09.00"
+composeRuntimeAnnotation = "1.12.1"
 coreKtx = "1.19.0"
 datastore = "1.2.1"
 devWhyolegCryptography = "0.6.0"
 espressoCore = "3.7.0"
-firebaseBom = "34.18.0"
+firebaseBom = "34.19.0"
 fragmentKtx = "1.9.0"
 gms = "4.5.0"
 healthConnect = "1.1.0"
@@ -36,8 +41,8 @@ kmpTorResource = "409.5.0"
 kodeinEmoji = "2.5.0"
 junit = "4.13.2"
 kchesslib = "1.0.5"
-kotlin = "2.4.10"
-kotlinxCollectionsImmutable = "0.5.1"
+kotlin = "2.4.20"
+kotlinxCollectionsImmutable = "0.5.2"
 kotlinxCoroutinesCore = "1.11.0"
 kotlinxSerialization = "1.11.0"
 genaiProofreading = "1.0.0-beta1"
@@ -50,27 +55,32 @@ lightcompressor-enhanced = "2.2.1"
 jlatexmath = "1.5"
 markdown = "4d3b3dd173"
 highlights = "1.1.0"
-material3 = "1.9.0"
-media3 = "1.11.0"
+# JetBrains material3 must track Compose Multiplatform's foundation: CMP 1.12.0 changed
+# the CustomStyle.applyStyle signature, so the stable 1.9.0 (and the 1.11.0-alpha07 that
+# kodein-emoji pulls in) crash at runtime with AbstractMethodError in OutlinedTextField.
+# 1.12.0-alpha03 is the first release built against foundation 1.12.x. Android keeps taking
+# androidx material3 from composeBom; this ref only drives desktop/iOS.
+material3 = "1.12.0-alpha03"
+media3 = "1.11.1"
 mockk = "1.14.11"
 kotlinx-coroutines-test = "1.11.0"
 negentropyKmp = "v1.2.0"
-navigationCompose = "2.9.8"
+navigationCompose = "2.10.1"
 okhttp = "5.5.0"
 osmdroid = "6.1.20"
 runner = "1.7.0"
 secp256k1KmpJniAndroid = "0.24.0"
 schnorr256k1Kmp = "1.0.5"
 securityCryptoKtx = "1.1.0"
-slf4j = "2.0.18"
-sonarqubeGradlePlugin = "7.4.0.8496"
-spotless = "8.10.0"
+slf4j = "2.0.19"
+sonarqubeGradlePlugin = "7.5.0.8588"
+spotless = "8.10.2"
 streamWebrtcAndroid = "1.3.10"
 translate = "17.0.3"
-jetbrainsCompose = "1.11.1"
+jetbrainsCompose = "1.12.0"
 unifiedpush = "3.0.10"
 playServicesCast = "22.3.1"
-vico-charts-compose = "3.3.0"
+vico-charts-compose = "3.3.1"
 zelory = "3.0.1"
 zoomable = "2.13.0"
 composemediaplayer = "0.11.4"
@@ -84,14 +94,14 @@ webkit = "1.17.0"
 privacysandboxUi = "1.0.0-alpha17"
 windowCoreAndroid = "1.5.1"
 workRuntime = "2.11.2"
-androidxCamera = "1.6.1"
+androidxCamera = "1.6.2"
 androidxCollection = "1.6.0"
 androidxProfileinstaller = "1.4.1"
 androidxExifinterface = "1.4.2"
-kotlinTest = "2.4.10"
+kotlinTest = "2.4.20"
 core = "1.7.0"
 mavenPublish = "0.37.0"
-sqlite = "2.7.0"
+sqlite = "2.7.1"
 ktor = "3.5.2"
 fourkoma = "1.2.0"
 
@@ -102,7 +112,7 @@ fourkoma = "1.2.0"
 # publish alpha10, but -service stopped at alpha09, and all three share this
 # ref. Check every artifact before bumping, not just the main one.
 appfunctions = "1.0.0-alpha09"
-ksp = "2.3.11"
+ksp = "2.3.12"
 
 [libraries]
 abedElazizShe-video-compressor-fork = { group = "com.github.davotoula", name = "LightCompressor-enhanced", version.ref = "lightcompressor-enhanced" }