diff --git a/pom.xml b/pom.xml
index 0efdd67..4582a90 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
         <!-- overwrite due to CVE-2023-2976 in Guice transitive dependencies -->
-        <version>33.4.0-jre</version>
+        <version>33.4.6-jre</version>
       </dependency>
     </dependencies>
   </dependencyManagement>
@@ -63,6 +63,12 @@
       <artifactId>guice</artifactId>
       <version>6.0.0</version>
     </dependency>
+    <!-- needed by Guava 33.4.3+ for javax.annotations.Nullable -->
+    <dependency>
+      <groupId>com.google.code.findbugs</groupId>
+      <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
+    </dependency>
     <dependency>
       <groupId>jakarta.annotation</groupId>
       <artifactId>jakarta.annotation-api</artifactId>