diff --git a/build.gradle b/build.gradle
index 8c7c36b0ed..92e9976b6d 100644
--- a/build.gradle
+++ b/build.gradle
@@ -248,6 +248,8 @@ allprojects {
                     // force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
                     force "org.apache.httpcomponents:httpcore:${httpcoreVersion}"
                     force "org.apache.httpcomponents.core5:httpcore5:${httpcore5Version}"
+                    // align httpcore5-h2 with httpcore5; the transitive 5.3.6 is exposed to CVE-2026-54399/CVE-2026-54428 (fixed in 5.4.3)
+                    force "org.apache.httpcomponents.core5:httpcore5-h2:${httpcore5Version}"
                     // force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
                     force "org.apache.httpcomponents:httpclient:${httpclientVersion}"
                     force "org.apache.httpcomponents.client5:httpclient5:${httpclient5Version}"
diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index 4c5e10925c..cc31a5443f 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -438,14 +438,15 @@
         <cve>CVE-2025-15104</cve>
     </suppress>
     <!--
-    CVE-2026-54399 is scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, is not listed as affected, and has no fixed 4.4.x release. False positive for the 4.x artifact.
+    CVE-2026-54399 (httpcore5 HTTP/1.1 parser) and CVE-2026-54428 (httpcore5-h2 HTTP/2 HPACK decoder) are both scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, has no HTTP/2 module, is not listed as affected, and has no fixed 4.4.x release. False positives for the 4.x artifact.
     -->
     <suppress>
         <notes><![CDATA[
-    file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVE)
+    file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVEs)
     ]]></notes>
         <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
         <cve>CVE-2026-54399</cve>
+        <cve>CVE-2026-54428</cve>
     </suppress>
     <!--
     CVE-2026-53914 is in the Kotlin compiler's build-cache deserialization. We don't compile Kotlin or use the Kotlin build