diff --git a/pom.xml b/pom.xml
index e117cff..cacbfb0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -47,6 +47,8 @@
         <httpasyncclient.version>4.1.4</httpasyncclient.version>
         <httpmime.version>4.5.12</httpmime.version>
         <tika-core.version>1.28.3</tika-core.version>
+        <!-- Override the commons-codec 1.11 pulled in transitively by httpclient -->
+        <commons-codec.version>1.22.0</commons-codec.version>
 
         <jackson-databind.version>2.22.1</jackson-databind.version>
 
@@ -158,6 +160,17 @@
         </dependency>
     </dependencies>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Force commons-codec above the vulnerable 1.11 that httpclient pulls in transitively -->
+            <dependency>
+                <groupId>commons-codec</groupId>
+                <artifactId>commons-codec</artifactId>
+                <version>${commons-codec.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <profiles>
         <profile>
             <id>unit-tests</id>