diff --git a/batch/pom.xml b/batch/pom.xml
index 47aa704e..192f3c58 100644
--- a/batch/pom.xml
+++ b/batch/pom.xml
@@ -11,7 +11,7 @@
   <name>SonarScanner Java Library - Batch</name>
 
   <properties>
-    <sonarQubeVersion>25.9.0.112764</sonarQubeVersion>
+    <sonarQubeVersion>26.4.0.121862</sonarQubeVersion>
   </properties>
 
   <dependencies>
@@ -71,7 +71,7 @@
     <dependency>
       <groupId>org.sonarsource.api.plugin</groupId>
       <artifactId>sonar-plugin-api</artifactId>
-      <version>13.2.0.3137</version>
+      <version>14.2.0.5584</version>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/lib/pom.xml b/lib/pom.xml
index cfb54602..d4afd84f 100644
--- a/lib/pom.xml
+++ b/lib/pom.xml
@@ -109,6 +109,39 @@
 
   <build>
     <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>enforce-runtime-java-compatibility</id>
+            <phase>verify</phase>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <!-- The compiler release setting only checks our sources. Bootstrap dependencies must also run on the host JVM,
+                     before JRE provisioning can launch the scanner engine on a newer Java version. -->
+                <enforceBytecodeVersion>
+                  <maxJdkVersion>${maven.compiler.release}</maxJdkVersion>
+                  <ignoredScopes>
+                    <ignoredScope>test</ignoredScope>
+                    <ignoredScope>provided</ignoredScope>
+                  </ignoredScopes>
+                </enforceBytecodeVersion>
+              </rules>
+            </configuration>
+          </execution>
+        </executions>
+        <dependencies>
+          <dependency>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>extra-enforcer-rules</artifactId>
+            <version>1.12.1</version>
+          </dependency>
+        </dependencies>
+      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-dependency-plugin</artifactId>
diff --git a/renovate.json b/renovate.json
index 14916104..864ef1ac 100644
--- a/renovate.json
+++ b/renovate.json
@@ -7,6 +7,13 @@
     "org.sonarsource.scanner.lib:it"
   ],
   "packageRules": [
+    {
+      "description": "Keep FastCSV on 3.x while scanner bootstrapping supports Java 11; FastCSV 4.x requires Java 17.",
+      "matchPackageNames": [
+        "de.siegmar:fastcsv"
+      ],
+      "allowedVersions": "<4.0.0"
+    },
     {
       "description": "Keep SLF4J 1.x compatibility for Scanner for Maven with Maven < 4.",
       "matchPackageNames": [