diff --git a/licenses.yaml b/licenses.yaml
index 8032c582975a..67fa07cbcdea 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -424,7 +424,7 @@ name: Caffeine
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 2.9.3
+version: 3.2.4
 libraries:
   - com.github.ben-manes.caffeine: caffeine
 
@@ -434,7 +434,7 @@ name: Error Prone Annotations
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 2.41.0
+version: 2.49.0
 libraries:
   - com.google.errorprone: error_prone_annotations
 
diff --git a/pom.xml b/pom.xml
index fa07aa254c1d..d871b7cdb289 100644
--- a/pom.xml
+++ b/pom.xml
@@ -96,7 +96,7 @@
         <datasketches.memory.version>2.2.0</datasketches.memory.version>
         <derby.version>10.17.1.0</derby.version>
         <dropwizard.metrics.version>4.2.22</dropwizard.metrics.version>
-        <errorprone.version>2.41.0</errorprone.version>
+        <errorprone.version>2.49.0</errorprone.version>
         <fabric8.version>7.6.0</fabric8.version>
         <fastutil.version>8.5.4</fastutil.version>
         <guava.version>32.1.3-jre</guava.version>
@@ -125,7 +125,7 @@
              It should be removed once those extensions are upgraded or dropped (see #19109). -->
         <aws.sdk.v1.version>1.12.793</aws.sdk.v1.version>
         <aws.sdk.v2.version>2.40.0</aws.sdk.v2.version>
-        <caffeine.version>2.9.3</caffeine.version>
+        <caffeine.version>3.2.4</caffeine.version>
         <jacoco.version>0.8.14</jacoco.version>
         <testcontainers.version>2.0.3</testcontainers.version>
         <hibernate-validator.version>6.2.5.Final</hibernate-validator.version>
diff --git a/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java b/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java
index b34fcbdd830c..35cfc4ddf42a 100644
--- a/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java
+++ b/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java
@@ -191,22 +191,21 @@ public long getSizeInBytes()
     final Cache.NamedKey key2 = new Cache.NamedKey("the", s2);
     final CaffeineCache cache = CaffeineCache.create(config, Runnable::run);
 
-    Assert.assertNull(cache.get(key1));
-    Assert.assertNull(cache.get(key2));
-
-    cache.put(key1, val1);
-    Assert.assertArrayEquals(val1, cache.get(key1));
-    Assert.assertNull(cache.get(key2));
-
     Assert.assertEquals(0, cache.getCache().stats().evictionWeight());
 
-    Assert.assertArrayEquals(val1, cache.get(key1));
-    Assert.assertNull(cache.get(key2));
-
+    // Two entries with combined weight exceeding the 40-byte maximum. Caffeine 3's W-TinyLFU
+    // admission policy chooses which to keep based on frequency; we don't assert on identity,
+    // only that eviction happened and the cache shrank back under its bound.
+    cache.put(key1, val1);
     cache.put(key2, val2);
-    Assert.assertNull(cache.get(key1));
-    Assert.assertArrayEquals(val2, cache.get(key2));
-    Assert.assertEquals(34, cache.getCache().stats().evictionWeight());
+    cache.getCache().cleanUp();
+
+    Assert.assertTrue(
+        "Expected eviction weight > 0 after exceeding max size, got "
+        + cache.getCache().stats().evictionWeight(),
+        cache.getCache().stats().evictionWeight() > 0
+    );
+    Assert.assertEquals(1, cache.getCache().asMap().size());
   }
 
   @Test