diff --git a/pom.xml b/pom.xml
index 6b7e40d..f267247 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,6 +18,9 @@
   <description>사내 통합 문서 뷰어 MVP</description>
 
   <properties>
+    <!-- Security: pin jackson to a trivy-confirmed patched version
+         (CVE-2026-54512..54515 in the parent-managed 2.19.0). -->
+    <jackson-bom.version>2.18.8</jackson-bom.version>
     <java.version>21</java.version>
     <maven.compiler.release>${java.version}</maven.compiler.release>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>