diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index aab6c04..f9f7e23 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,6 +15,12 @@ updates:
       # Nimbus whichever dependency it declares first. A Quarkus application gets the version of its
       # BOM regardless. The pin moves together with the Spring Boot bump, not on its own.
       - dependency-name: "com.nimbusds:nimbus-jose-jwt"
+      # The Maven wrapper stays on 3.9.x: Maven 3.10 (Resolver 2) writes _remote.repositories marker
+      # files into the staging directory of the central-publishing-maven-plugin, and Central rejects
+      # the bundle ("Bundle has content that does NOT have a .pom file"). Lift this once the plugin
+      # (0.11.0 as of 2026-10-04) excludes them, see CONTRIBUTING.md.
+      - dependency-name: "org.apache.maven:apache-maven"
+        update-types: ["version-update:semver-minor", "version-update:semver-major"]
     groups:
       spring:
         patterns:
diff --git a/.lychee.toml b/.lychee.toml
index ee6c1d3..384fc02 100644
--- a/.lychee.toml
+++ b/.lychee.toml
@@ -22,4 +22,6 @@ exclude = [
   "^mailto:",
   # requires a logged-in GitHub user
   "^https://github\\.com/easyssf/easyssf/security/advisories/new$",
+  # the compare links of CHANGELOG.md name the tag of a release before it is pushed
+  "^https://github\\.com/easyssf/easyssf/compare/",
 ]
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
index bb58b3c..216df05 100644
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -1,3 +1,3 @@
 wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.10.0/apache-maven-3.10.0-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b8dd3cc..fc2b938 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -46,6 +46,16 @@ to submit the change under the project's license. The CI checks it for every com
 - **`.mvn/jvm.config`** silences the schema validator inside the CycloneDX plugin, which warns about
   keywords of the CycloneDX schema it does not know (`meta:enum`, `deprecated`) on every build. The file
   takes JVM arguments only, so this is where its one line is explained.
+- **Maven 3.9.x**: the wrapper (`.mvn/wrapper/maven-wrapper.properties`) stays on Maven 3.9 for now.
+  Maven 3.10 uses Resolver 2, which writes `_remote.repositories` marker files (and their checksums)
+  into the staging directory the `central-publishing-maven-plugin` bundles, and Central rejects the
+  bundle with "Bundle has content that does NOT have a .pom file"; the first attempt to release 0.2.0
+  failed that way. Dependabot ignores minor and major Maven updates for that reason. Try 3.10 again
+  once the plugin (0.11.0 as of 2026-10-04) excludes those files: build the bundle locally with
+  `./mvnw -Prelease -Dgpg.skip -DskipTests deploy` against dummy credentials and check
+  `target/central-publishing/central-bundle.zip` for `_remote.repositories`. The settings step of the
+  workflows that scopes the Central credentials (`repositoryOrigins`, needed by 3.10) stays: Maven 3.9
+  only warns about the unknown tag.
 - **Database tests**: the JDBC stores are tested on H2 by the normal build and on PostgreSQL in a
   Testcontainers container by the tests tagged `database`, which the normal build excludes:
   `./mvnw -pl easyssf-receiver-jdbc -Pdatabase-tests verify` runs them (Docker required). CI runs