diff --git a/bom/bom-verification/build.gradle b/bom/bom-verification/build.gradle
index 376d5b8..fc03e95 100644
--- a/bom/bom-verification/build.gradle
+++ b/bom/bom-verification/build.gradle
@@ -53,6 +53,15 @@ dependencies {
         exclude group: 'io.camunda', module: 'identity-sdk'
     }
     implementation 'io.camunda:zeebe-client-java'
+    // Broker-side APIs + the metrics client they come with, used by the Kafka
+    // exporter plugin in paymenthub-ee-data-pipeline.
+    implementation 'io.camunda:zeebe-exporter-api'
+    implementation 'io.camunda:zeebe-protocol'
+    implementation 'io.prometheus:simpleclient'
+
+    // Kafka client (managed by the Spring Boot BOM) — the exporter plugin and
+    // the importers all talk to the same Kafka topic.
+    implementation 'org.apache.kafka:kafka-clients'
 
     // Jakarta EE 10
     implementation 'jakarta.validation:jakarta.validation-api'
diff --git a/bom/build.gradle b/bom/build.gradle
index 714e577..6f01701 100644
--- a/bom/build.gradle
+++ b/bom/build.gradle
@@ -48,6 +48,23 @@ dependencies {
         api "io.camunda:spring-zeebe-starter:${zeebeVersion}"
         api "io.camunda:zeebe-client-java:${zeebeVersion}"
         api "io.camunda:zeebe-bpmn-model:${zeebeVersion}"
+        // Broker-side APIs, used by the Kafka exporter plugin in
+        // paymenthub-ee-data-pipeline. The plugin takes them compileOnly: the
+        // broker already holds these classes and supplies them at runtime, so
+        // none of this ends up in the exporter jar. They do NOT have to equal
+        // the version of the running broker -- the Exporter SPI is stable across
+        // the 8.x line, and the exporter deployed today is built against 8.1.1
+        // and runs fine in a broker that is not 8.1. They follow zeebeVersion to
+        // stay consistent with the clients above, which is the only reason.
+        api "io.camunda:zeebe-exporter-api:${zeebeVersion}"
+        api "io.camunda:zeebe-protocol:${zeebeVersion}"
+
+        // ── Prometheus client ─────────────────────────────────────────────────
+        // The Zeebe broker exposes its metrics through the legacy Prometheus
+        // simpleclient and ships 0.16.0. The Kafka exporter registers its own
+        // histograms in that same registry, so it compiles against the version
+        // the broker carries -- compileOnly, for the same reason as above.
+        api "io.prometheus:simpleclient:${prometheusSimpleclientVersion}"
 
         // ── Apache CXF ────────────────────────────────────────────────────────
         // CXF 3.x uses javax.*; CXF 4.x uses jakarta.*.
diff --git a/gradle.properties b/gradle.properties
index 41b23b1..99f996c 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -78,6 +78,14 @@ mastercardOauth1Version=1.5.3
 # JSON — org.json is not managed by the Spring Boot BOM.
 orgJsonVersion=20240303
 
+# Prometheus simpleclient — the legacy metrics client the Zeebe broker ships.
+# The 8.x brokers carry 0.16.0, 8.5 included, so this is not tied to one
+# broker version.
+# Spring Boot 3 manages the newer io.prometheus:prometheus-metrics-* line instead,
+# so the legacy simpleclient has to be pinned here. Used by the Kafka exporter
+# plugin (paymenthub-ee-data-pipeline), which registers histograms in the broker.
+prometheusSimpleclientVersion=0.16.0
+
 # Elasticsearch 7 legacy REST high-level client.
 # ph-ee-zeebe-ops (and likely ph-ee-importer-es) still code against the ES7
 # RestHighLevelClient API, which Spring Boot 3 / Spring Data ES 5 no longer