diff --git a/Dockerfile b/Dockerfile
index 7bd2fdf1..859c471d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,7 +30,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \
     /usr/local/bundle/cache/ruby-maven-*
 
 # Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl
-# 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime.
+# 0.15.3 (CVE-2026-5588); the pinned 0.16.2 gem provides BC 1.85 at runtime
+# (CVE-2026-12185 and sibling BC 1.84 CVEs).
 # Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default
 # gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem
 # from the Gemfile provides the fixed version at runtime.
diff --git a/Dockerfile.wolfi b/Dockerfile.wolfi
index 51cbc9e7..e222fbb7 100644
--- a/Dockerfile.wolfi
+++ b/Dockerfile.wolfi
@@ -63,7 +63,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \
     /usr/local/bundle/cache/ruby-maven-*
 
 # Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl
-# 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime.
+# 0.15.3 (CVE-2026-5588); the pinned 0.16.2 gem provides BC 1.85 at runtime
+# (CVE-2026-12185 and sibling BC 1.84 CVEs).
 # Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default
 # gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem
 # from the Gemfile provides the fixed version at runtime.
diff --git a/Gemfile b/Gemfile
index f10abb10..e0ef164f 100644
--- a/Gemfile
+++ b/Gemfile
@@ -38,9 +38,10 @@ group :default do
   gem 'erb', '4.0.4.1'
   gem 'rufus-scheduler', '~> 3.9.1'
 
-  # jruby-openssl 0.16.0 bundles Bouncy Castle 1.84, fixing CVE-2026-5588.
-  # JRuby 9.4.12.0's default jruby-openssl 0.15.3 ships the vulnerable 1.79.
-  gem 'jruby-openssl', '0.16.0', platform: :jruby
+  # jruby-openssl 0.16.2 bundles Bouncy Castle 1.85, fixing CVE-2026-12185
+  # (and clearing the remaining BC 1.84 CVE cluster). JRuby 9.4.12.0's default
+  # jruby-openssl 0.15.3 ships BC 1.79; older pin 0.16.0 shipped BC 1.84.
+  gem 'jruby-openssl', '0.16.2', platform: :jruby
 
   # JRuby 9.4.12.0 ships net-imap 0.2.3 as a default gem. Pin above the fixed
   # lines for CVE-2026-42246 / CVE-2026-42257 / CVE-2026-42245 / CVE-2026-42258
diff --git a/Gemfile.lock b/Gemfile.lock
index d903c670..cb5a89bc 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -69,7 +69,7 @@ GEM
     i18n (1.15.2)
       concurrent-ruby (~> 1.0)
     ipaddr (1.2.6)
-    jruby-openssl (0.16.0-java)
+    jruby-openssl (0.16.2-java)
     json (2.7.2-java)
     json-schema (4.3.0)
       addressable (>= 2.8)
@@ -191,7 +191,7 @@ DEPENDENCIES
   faux!
   httpclient
   ipaddr (~> 1.2.4)
-  jruby-openssl (= 0.16.0)
+  jruby-openssl (= 0.16.2)
   json (~> 2.7.2)
   json-schema (~> 4.3.0)
   net-imap (= 0.5.15)
diff --git a/Jarfile b/Jarfile
index 89eda468..cbd05d37 100644
--- a/Jarfile
+++ b/Jarfile
@@ -29,7 +29,7 @@ jar 'org.jsoup:jsoup', '1.23.1'
 # Cleaner Java logs handling
 jar 'org.slf4j:slf4j-nop', '1.7.26'
 
-# Pinned transitive to resolve CVE-2026-59646
+# Pinned transitive to resolve CVE-2026-59646 / CVE-2026-12185 (BC < 1.85)
 jar 'org.bouncycastle:bcprov-jdk18on', '1.85'
 jar 'org.bouncycastle:bcpkix-jdk18on', '1.85'
 jar 'org.bouncycastle:bctls-jdk18on',  '1.85'
diff --git a/NOTICE.txt b/NOTICE.txt
index 9ba2f911..bd48affe 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1597,7 +1597,7 @@ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGE.
 
 --------------------------------------------------------------------------------
-Library: jruby-openssl 0.16.0
+Library: jruby-openssl 0.16.2
 URL: https://github.com/jruby/jruby-openssl
 License: EPL-1.0 OR GPL-2.0 OR LGPL-2.1