diff --git a/android-test/build.gradle.kts b/android-test/build.gradle.kts
index bc0e5212c78b..e252bfb6c174 100644
--- a/android-test/build.gradle.kts
+++ b/android-test/build.gradle.kts
@@ -101,6 +101,7 @@ dependencies {
   }
   androidTestImplementation(libs.assertk)
   androidTestImplementation(libs.bouncycastle.bcprov)
+  androidTestImplementation(libs.bouncycastle.bcutil)
   androidTestImplementation(libs.bouncycastle.bctls)
   androidTestImplementation(libs.conscrypt.android)
   androidTestImplementation(projects.mockwebserver3Junit4)
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 06bce4a8b7fe..50e5579bf84b 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -43,7 +43,8 @@ maven-sympathy = "0.3.0"
 mockserver-client = "5.15.0"
 mrjar = "0.1.1"
 openjsse = "1.1.14"
-org-bouncycastle = "1.84"
+org-bouncycastle = "1.85"
+org-bouncycastle-patch = "1.85.1"
 org-conscrypt = "2.6.1"
 org-junit-jupiter = "5.13.4"
 playservices-safetynet = "18.1.0"
@@ -80,7 +81,8 @@ aqute-bnd = { module = "biz.aQute.bnd:biz.aQute.bnd", version.ref = "bnd" }
 aqute-resolve = { module = "biz.aQute.bnd:biz.aQute.resolve", version.ref = "bnd" }
 assertk = { module = "com.willowtreeapps.assertk:assertk", version.ref = "assertk" }
 bouncycastle-bcpkix = { module = "org.bouncycastle:bcpkix-jdk15to18", version.ref = "org-bouncycastle" }
-bouncycastle-bcprov = { module = "org.bouncycastle:bcprov-jdk15to18", version.ref = "org-bouncycastle" }
+bouncycastle-bcprov = { module = "org.bouncycastle:bcprov-jdk15to18", version.ref = "org-bouncycastle-patch" }
+bouncycastle-bcutil = { module = "org.bouncycastle:bcutil-jdk15to18", version.ref = "org-bouncycastle-patch" }
 bouncycastle-bctls = { module = "org.bouncycastle:bctls-jdk15to18", version.ref = "org-bouncycastle" }
 brotli-dec = { module = "org.brotli:dec", version.ref = "brotli-dec" }
 checkstyle = { module = "com.puppycrawl.tools:checkstyle", version.ref = "checkstyle" }
diff --git a/okhttp-testing-support/build.gradle.kts b/okhttp-testing-support/build.gradle.kts
index c132d91e946b..7ae2e261c939 100644
--- a/okhttp-testing-support/build.gradle.kts
+++ b/okhttp-testing-support/build.gradle.kts
@@ -15,6 +15,7 @@ dependencies {
   api(libs.assertk)
   api(libs.bouncycastle.bcprov)
   implementation(libs.bouncycastle.bcpkix)
+  implementation(libs.bouncycastle.bcutil)
   implementation(libs.bouncycastle.bctls)
   api(libs.conscrypt.openjdk)
   api(libs.openjsse)
diff --git a/okhttp/build.gradle.kts b/okhttp/build.gradle.kts
index 15d24f092949..0d777778ca84 100644
--- a/okhttp/build.gradle.kts
+++ b/okhttp/build.gradle.kts
@@ -119,6 +119,7 @@ kotlin {
       dependsOn(commonJvmAndroid)
       dependencies {
         compileOnly(libs.bouncycastle.bcprov)
+        compileOnly(libs.bouncycastle.bcutil)
         compileOnly(libs.bouncycastle.bctls)
         compileOnly(libs.conscrypt.openjdk)
         implementation(libs.androidx.annotation)
@@ -133,6 +134,7 @@ kotlin {
         // These compileOnly dependencies must also be listed in applyOsgiMultiplatform() below.
         compileOnly(libs.conscrypt.openjdk)
         compileOnly(libs.bouncycastle.bcprov)
+        compileOnly(libs.bouncycastle.bcutil)
         compileOnly(libs.bouncycastle.bctls)
 
         // graal build support
diff --git a/regression-test/build.gradle.kts b/regression-test/build.gradle.kts
index 522294381bd0..ca772a12ed3b 100644
--- a/regression-test/build.gradle.kts
+++ b/regression-test/build.gradle.kts
@@ -43,6 +43,7 @@ dependencies {
   }
   androidTestImplementation("com.squareup.okhttp3:mockwebserver:${okhttpLegacyVersion}")
   androidTestImplementation(libs.bouncycastle.bcprov)
+  androidTestImplementation(libs.bouncycastle.bcutil)
   androidTestImplementation(libs.bouncycastle.bctls)
   androidTestImplementation(libs.androidx.junit)
   androidTestImplementation(libs.androidx.espresso.core)