diff --git a/.github/workflows/jenkins-security-scan.yml b/.github/workflows/jenkins-security-scan.yml
index 37c7f9a..36a8fda 100644
--- a/.github/workflows/jenkins-security-scan.yml
+++ b/.github/workflows/jenkins-security-scan.yml
@@ -15,8 +15,54 @@ permissions:
   actions: read
 
 jobs:
-  security-scan:
-    uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
-    with:
-      java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate.
-      # java-version: 21 # Optionally specify what version of Java to set up for the build, or remove to use a recent default.
+  scan:
+    runs-on: ubuntu-latest # Provides `jq`
+    steps:
+      - name: Setup Maven Action
+        uses: s4u/setup-maven-action@v1.14.0
+        with:
+          java-distribution: 'temurin'
+          java-version: ${{ inputs.java-version || '17' }}
+          maven-version: ${{ inputs.maven-version || '3.9.9' }}
+          cache-enabled: ${{ inputs.java-cache }}
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: java
+          config: |
+            disable-default-queries: true
+            packs:
+            - jenkins-infra/jenkins-codeql@0.0.2
+            - codeql/java-queries:AlertSuppression.ql
+            - codeql/java-queries:AlertSuppressionAnnotations.ql
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Run CodeQL
+        id: generate-sarif
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: Jenkins Security Scan
+          upload: failure-only
+
+      - name: Process SARIF
+        # Process the generated SARIF file:
+        # 1. Prevent conflicts with otherwise set up CodeQL scan by renaming the tool driver
+        # 2. Remove suppressed warnings because GitHub Code Scanning does not support inline suppressions
+        run: |
+          jq 'setpath(path(.runs[].tool.driver.name); "Jenkins Security Scan") | setpath(path(.runs[].tool.driver.organization); "Jenkins Project") | del(.runs[].results[] | select( .suppressions | length != 0 ))' ../results/java.sarif > jenkins-security-scan.sarif
+          mv -v ../results/java.sarif .
+
+      - name: Archive SARIF
+        uses: actions/upload-artifact@v4
+        with:
+          path: '*.sarif'
+          name: Jenkins Security Scan SARIF
+
+      - name: Upload Scan Result
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: jenkins-security-scan.sarif
+          category: Jenkins Security Scan
diff --git a/pom.xml b/pom.xml
index 3203c0e..895d4f2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,23 +26,27 @@
     <url>https://github.com/${gitHubRepo}</url>
   </scm>
   <properties>
-    <revision>9.22.3</revision>
+    <revision>10.17.3</revision>
     <changelist>999999-SNAPSHOT</changelist>
-    <jenkins.baseline>2.440</jenkins.baseline>
-    <jenkins.version>${jenkins.baseline}.3</jenkins.version>
+    <jenkins.baseline>weekly</jenkins.baseline>
+    <jenkins.version>2.475</jenkins.version>
     <gitHubRepo>jenkinsci/${project.artifactId}-plugin</gitHubRepo>
     <spotless.check.skip>false</spotless.check.skip>
 
     <!-- Test dependencies version -->
     <testcontainer.version>1.20.1</testcontainer.version>
 
+    <!-- TODO JENKINS-73339 until in parent POM -->
+    <jenkins-test-harness.version>2254.vcff7a_d4969e5</jenkins-test-harness.version>
+    <maven.compiler.release>17</maven.compiler.release>
+
   </properties>
 
   <dependencyManagement>
     <dependencies>
       <dependency>
         <groupId>io.jenkins.tools.bom</groupId>
-        <artifactId>bom-${jenkins.baseline}.x</artifactId>
+        <artifactId>bom-weekly</artifactId>
         <version>3334.v18e2a_2f48356</version>
         <type>pom</type>
         <scope>import</scope>
@@ -59,6 +63,11 @@
         <version>${revision}</version>
         <type>zip</type>
       </dependency>
+      <dependency>
+        <groupId>org.flywaydb</groupId>
+        <artifactId>flyway-database-postgresql</artifactId>
+        <version>${revision}</version>
+      </dependency>
       <dependency>
         <groupId>org.flywaydb</groupId>
         <artifactId>flyway-mysql</artifactId>
@@ -88,12 +97,21 @@
           <groupId>com.fasterxml.jackson.dataformat</groupId>
           <artifactId>jackson-dataformat-toml</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>com.fasterxml.jackson.datatype</groupId>
+          <artifactId>jackson-datatype-jsr310</artifactId>
+        </exclusion>
         <exclusion>
           <groupId>com.google.code.gson</groupId>
           <artifactId>gson</artifactId>
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>org.flywaydb</groupId>
+      <artifactId>flyway-database-postgresql</artifactId>
+    </dependency>
+
     <dependency>
       <groupId>org.flywaydb</groupId>
       <artifactId>flyway-mysql</artifactId>
@@ -102,6 +120,10 @@
       <groupId>org.flywaydb</groupId>
       <artifactId>flyway-sqlserver</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.jenkins-ci.plugins</groupId>
+      <artifactId>jackson2-api</artifactId>
+    </dependency>
 
     <!-- Test dependencies -->
     <dependency>
@@ -226,11 +248,22 @@
   </pluginRepositories>
 
   <build>
+
     <resources>
       <resource>
         <filtering>true</filtering>
         <directory>src/main/resources</directory>
       </resource>
     </resources>
+
+    <pluginManagement>
+      <plugins>
+        <plugin>
+          <groupId>org.jenkins-ci.tools</groupId>
+          <artifactId>maven-hpi-plugin</artifactId>
+          <version>3.58-rc1621.0cb_cd49b_b_c68</version>
+        </plugin>
+      </plugins>
+    </pluginManagement>
   </build>
 </project>