diff --git a/aws-junit/pom.xml b/aws-junit/pom.xml
index 646f598c..dde32970 100644
--- a/aws-junit/pom.xml
+++ b/aws-junit/pom.xml
@@ -21,12 +21,27 @@
   <properties>
     <main.basedir>${project.basedir}/..</main.basedir>
 
+    <!-- CVE fix versions -->
+    <!-- TODO: considering switching to something that doesn't use scala, such
+         as testcontainers+localstack, as CVEs are common here. -->
+    <scala.version>2.13.13</scala.version>
+
     <!-- Only used in this repo's tests, which use floor JDK 17 -->
     <maven.compiler.source>17</maven.compiler.source>
     <maven.compiler.target>17</maven.compiler.target>
     <maven.compiler.release>17</maven.compiler.release>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.scala-lang</groupId>
+        <artifactId>scala-library</artifactId>
+        <version>${scala.version}</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>io.zipkin.zipkin2</groupId>
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 5d63d12a..387aee02 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -4,7 +4,7 @@
 #
 
 # zipkin version should match zipkin.version in /pom.xml
-ARG zipkin_version=3.2.1
+ARG zipkin_version=3.3.0
 
 # java_version is used during the installation process to build or download the module jar.
 #
diff --git a/pom.xml b/pom.xml
index 6e8e44f0..70904ace 100644
--- a/pom.xml
+++ b/pom.xml
@@ -69,7 +69,7 @@
     <!-- matching armeria/grpc/zipkin -->
     <zipkin.groupId>io.zipkin.zipkin2</zipkin.groupId>
     <!-- when updating, update docker/Dockerfile and storage/src/test/java/zipkin2/storage/kafka/IT* -->
-    <zipkin.version>3.2.1</zipkin.version>
+    <zipkin.version>3.3.0</zipkin.version>
     <zipkin-reporter.version>3.4.0</zipkin-reporter.version>
     <spring-boot.version>3.2.4</spring-boot.version>
     <jackson.version>2.17.0</jackson.version>