diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 48c4f59..41cd6ee 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -26,3 +26,21 @@ jobs:
           cache: maven
       - name: Build and verify
         run: mvn -B verify
+
+  # Aggregation gate: exposes a single, stable status check ("ci-success") that
+  # is independent of the build matrix. Set this as the required status check in
+  # branch protection instead of the matrix-dependent "build (21)" context.
+  ci-success:
+    name: ci-success
+    if: always()
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify build job succeeded
+        run: |
+          if [ "${{ needs.build.result }}" != "success" ]; then
+            echo "build job did not succeed: ${{ needs.build.result }}"
+            exit 1
+          fi
+          echo "All required jobs succeeded."
+
diff --git a/pom.xml b/pom.xml
index 77cdf4e..72611b2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -62,8 +62,8 @@
 	<!-- Plugin / tooling versions -->
 	<spotless.version>2.44.3</spotless.version>
 	<google-java-format.version>1.25.2</google-java-format.version>
-	<errorprone.version>2.36.0</errorprone.version>
-	<nullaway.version>0.12.3</nullaway.version>
+	<errorprone.version>2.50.0</errorprone.version>
+	<nullaway.version>0.13.8</nullaway.version>
 	<spotbugs.version>4.10.3.0</spotbugs.version>
 	<dependency-check.version>13.0.0</dependency-check.version>
   </properties>
@@ -275,6 +275,7 @@
           </annotationProcessorPaths>
           <compilerArgs>
             <arg>-XDcompilePolicy=simple</arg>
+            <arg>-XDaddTypeAnnotationsToSymbol=true</arg>
             <arg>--should-stop=ifError=FLOW</arg>
             <arg>-Xplugin:ErrorProne -XepExcludedPaths:.*/scratch/.* -Xep:NullAway:WARN -XepOpt:NullAway:AnnotatedPackages=com.rsh.jtoolkit</arg>
             <arg>--add-opens</arg>