diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6fb229..3f211e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Tests**: integration tests overrode a wrong property name (`kafka-wrapper.data-dir`) and rewrote the developer's real `./data` directory on every run — both suites now point `kview.data-dir` at `target/`.
 
 ### Changed
+- **Spring Boot 3.3.4 → 3.5.16** (completes the release plan's P2.3 — the 3.3 line is past OSS support end): lifts Spring Framework to 6.2.x, Spring Security to 6.5.x, spring-kafka to 3.3.x, micrometer to 1.15.x and **kafka-clients to 3.9.2**; `KafkaClusterManager` now passes `SslBundles` to the Kafka properties builders, as required by the new builder signatures.
 - Docs: corrected the README `reset-offsets` example; the README roadmap and COMPATIBILITY.md no longer describe the shipped Schema Registry support (Avro/JSON) as unbuilt; internal working documents moved from the repo root to `docs/`.
 - Removed the divergent legacy `kview-cli.js` client; `cli/kview.mjs` is the CLI.
 - CI: the MCP server startup is now smoke-tested on Node 20 (which would have caught the ESM crash), alongside the CLI smoke test.
diff --git a/pom.xml b/pom.xml
index 2f7c006..d01a1ac 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>3.3.4</version>
+    <version>3.5.16</version>
     <relativePath/>
   </parent>
 
diff --git a/src/main/java/com/ritikbansod/kafkawrapper/connection/KafkaClusterManager.java b/src/main/java/com/ritikbansod/kafkawrapper/connection/KafkaClusterManager.java
index c930dec..0ef8650 100644
--- a/src/main/java/com/ritikbansod/kafkawrapper/connection/KafkaClusterManager.java
+++ b/src/main/java/com/ritikbansod/kafkawrapper/connection/KafkaClusterManager.java
@@ -38,11 +38,14 @@ public class KafkaClusterManager {
 
     private final ConnectionStore store;
     private final KafkaProperties springKafkaProperties;
+    private final org.springframework.boot.ssl.SslBundles sslBundles;
     private final Map<String, ClusterHandle> handles = new ConcurrentHashMap<>();
 
-    public KafkaClusterManager(ConnectionStore store, KafkaProperties springKafkaProperties) {
+    public KafkaClusterManager(ConnectionStore store, KafkaProperties springKafkaProperties,
+                               org.springframework.boot.ssl.SslBundles sslBundles) {
         this.store = store;
         this.springKafkaProperties = springKafkaProperties;
+        this.sslBundles = sslBundles;
     }
 
     public ConnectionProfile profileOf(String clusterId) {
@@ -134,9 +137,9 @@ private ClusterHandle createHandle(ConnectionProfile profile, boolean builtIn) {
         consumerProps.put("auto.offset.reset", "earliest");
 
         if (builtIn) {
-            adminProps = springKafkaProperties.buildAdminProperties();
-            producerProps = springKafkaProperties.buildProducerProperties();
-            consumerProps = springKafkaProperties.buildConsumerProperties();
+            adminProps = springKafkaProperties.buildAdminProperties(sslBundles);
+            producerProps = springKafkaProperties.buildProducerProperties(sslBundles);
+            consumerProps = springKafkaProperties.buildConsumerProperties(sslBundles);
             // byte pipeline wins over yml-configured String serdes (raw fidelity for SR payloads)
             producerProps.put("key.serializer", "org.apache.kafka.common.serialization.ByteArraySerializer");
             producerProps.put("value.serializer", "org.apache.kafka.common.serialization.ByteArraySerializer");