diff --git a/build.gradle b/build.gradle
index 712a040bee..5a3bf60f2a 100644
--- a/build.gradle
+++ b/build.gradle
@@ -224,6 +224,8 @@ allprojects {
                     force "com.google.guava:guava:${guavaVersion}"
                     // force version for SequenceAnalysis, TargetedMS
                     force "com.google.protobuf:protobuf-java:${googleProtocolBufVersion}"
+                    // force version for Cloud, FileTransfer, SequenceAnalysis, etc.
+                    force "com.google.code.findbugs:jsr305:${jsr305Version}"
                     // force Jakarta Activation API version used by our Angus Activation implementation
                     force "jakarta.activation:jakarta.activation-api:${jakartaActivationApiVersion}"
                     // force version for accounts, api, query
diff --git a/gradle.properties b/gradle.properties
index ea50f160bf..69c377b973 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -168,7 +168,7 @@ gsonVersion=2.8.9
 
 grpcVersion=1.71.0
 
-guavaVersion=33.4.0-jre
+guavaVersion=33.4.6-jre
 
 # Note: You won't find usages in the product sources; this property is used by the gradle plugin.
 gwtVersion=2.11.0
@@ -225,7 +225,7 @@ jmockVersion=2.6.0
 
 jodaTimeVersion=2.14.0
 
-# brought in transitively from guava and other google packages. Need to resolve consistently
+# brought in transitively by Cloud, FileTransfer, SequenceAnalysis, etc. Need to resolve consistently
 jsr305Version=3.0.2
 
 orgJsonVersion=20250107
@@ -248,12 +248,11 @@ mssqlJdbcVersion=12.10.0.jre11
 
 mysqlDriverVersion=9.2.0
 
-# forced compatibility between docker and UserReg-WS
+# force for docker
 nettyVersion=4.1.119.Final
 
 objenesisVersion=1.0
 
-# increase from 2.0 for remoteclientapi/java
 opencsvVersion=2.3
 
 openTracingVersion=0.33.0