diff --git a/Changelog.md b/Changelog.md
index 6a50f3d..b4686b2 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,6 +1,11 @@
 # Changelog
 
-### 1.6.0 - 6 August 2026
+### 1.6.0 - 1 October 2026
+* Updated the bundled OkHttp to 5.4.0, kotlin-stdlib to 2.4.0 and okio to 3.18.2. OkHttp and okio are now
+  referenced by their `-jvm` artifacts: OkHttp 5 is a Kotlin Multiplatform release whose plain `okhttp` artifact
+  carries no classes for Maven builds.
+* java-jwt is now a test-only dependency, so neither it nor the Jackson libraries it pulls in are part of the
+  client's dependency tree anymore.
 * Capture the remember-device cookie on WebAuthn and passkey authentications (previously only the OTP path
   propagated the Set-Cookie, so "remember this device" silently did nothing with a security key / passkey).
 * Add a getTokenInfo(username, headers) overload so callers can forward request headers on GET /token
diff --git a/pom.xml b/pom.xml
index e61a60b..034786e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -91,12 +91,12 @@
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
-            <artifactId>okhttp</artifactId>
-            <version>4.12.0</version>
+            <artifactId>okhttp-jvm</artifactId>
+            <version>5.4.0</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okio</groupId>
-            <artifactId>okio</artifactId>
+            <artifactId>okio-jvm</artifactId>
             <version>3.18.2</version>
         </dependency>
         <dependency>
@@ -116,10 +116,24 @@
             <version>2.0.19</version>
             <scope>test</scope>
         </dependency>
+        <!-- Only used by the tests to build JWTs; the client itself does not decode them with it. -->
         <dependency>
             <groupId>com.auth0</groupId>
             <artifactId>java-jwt</artifactId>
-            <version>4.6.0</version>
+            <version>4.6.1</version>
+            <scope>test</scope>
         </dependency>
     </dependencies>
+    <dependencyManagement>
+        <dependencies>
+            <!-- Align the Jackson modules java-jwt pulls in on the current patch release. -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>2.22.3</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>