diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0b3b040..4a69ea3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,14 +1,22 @@
 # Change Log
 
-## [0.11.3](https://github.com/auth0/Guardian.Android/tree/0.11.3) (2026-10-21)
+## [0.11.3](https://github.com/auth0/Guardian.Android/tree/0.11.3) (2026-11-11)
 [Full Changelog](https://github.com/auth0/Guardian.Android/compare/0.11.2...0.11.3)
 
+**Security**
+- Bump `com.auth0:java-jwt` from `4.6.1` to `4.6.2` and update the `com.fasterxml.jackson:jackson-bom` pin from `2.22.2` to `2.22.4`, and declare `jackson-core` and `jackson-databind` directly so every consumer resolves the patched version. Addresses CVE-2026-85473 in `java-jwt`, CVE-2026-89425 and CVE-2026-89407 in `jackson-core`, and CVE-2026-91776, CVE-2026-91777 and CVE-2026-110879 in `jackson-databind`.
+
 **Changed**
 - Release/0.11.2 (see [PR](https://github.com/auth0/Guardian.Android/pull/158))
 - GHA CI/CD implementation (see [PR](https://github.com/auth0/Guardian.Android/pull/159))
 - Initial release pipeline (see [PR](https://github.com/auth0/Guardian.Android/pull/161))
 - Fix signing secret name, add coverage to release test job, remove secret debugging (see [PR](https://github.com/auth0/Guardian.Android/pull/164))
 - NAPP-173: merge the release PR before tagging and publishing (see [PR](https://github.com/auth0/Guardian.Android/pull/168))
+- Release pipeline fixes from the first live releases (Android side of NAPP-177 to NAPP-186) (see [PR](https://github.com/auth0/Guardian.Android/pull/202))
+- Bump the actions group across 1 directory with 3 updates (see [PR](https://github.com/auth0/Guardian.Android/pull/188))
+- Bump ruby/setup-ruby from 1.331.0 to 1.335.0 in the actions group (see [PR](https://github.com/auth0/Guardian.Android/pull/204))
+- [NAPP-167] Fix the Guardian.Android sample app so it compiles and is ready for integration tests (see [PR](https://github.com/auth0/Guardian.Android/pull/206))
+- chore: move OpsLevel ownership to authn_-_native_apps (see [PR](https://github.com/auth0/Guardian.Android/pull/205))
 
 ## [0.11.2](https://github.com/auth0/Guardian.Android/tree/0.11.2) (2026-10-01)
 [Full Changelog](https://github.com/auth0/Guardian.Android/compare/0.11.1...0.11.2)
diff --git a/guardian/build.gradle b/guardian/build.gradle
index 733f105..c8d3df4 100644
--- a/guardian/build.gradle
+++ b/guardian/build.gradle
@@ -167,9 +167,13 @@ dependencies {
     implementation 'com.squareup.okhttp3:okhttp'
     implementation 'com.squareup.okhttp3:logging-interceptor'
     // JWT signing/verification
-    implementation 'com.auth0:java-jwt:4.6.1'
-    // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt)
-    implementation platform('com.fasterxml.jackson:jackson-bom:2.22.2')
+    implementation 'com.auth0:java-jwt:4.6.2'
+    // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt).
+    // Declared directly, with an explicit version, so Maven consumers (nearest-wins) and POM-only
+    // scanners also resolve the patched version. Keep these in sync with the BOM above.
+    implementation platform('com.fasterxml.jackson:jackson-bom:2.22.4')
+    implementation 'com.fasterxml.jackson.core:jackson-core:2.22.4'
+    implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4'
 
     testImplementation 'com.squareup.okhttp3:mockwebserver'
     // Mockito