diff --git a/.gitattributes b/.gitattributes
index 168718f98..24d0ad166 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,4 +4,11 @@
 
 # Isolate binary files in case the auto-detection algorithm fails and
 # marks them as text files (which could brick them).
-*.{png,jpg,jpeg,gif,webp,woff,woff2} binary
\ No newline at end of file
+*.{png,jpg,jpeg,gif,webp,woff,woff2} binary
+
+# Keep this branch's own copy of these files when syncing main into v5.
+# `.version` and README carry v5-specific content, so always keep ours.
+.version     merge=ours
+README.md    merge=ours
+# CHANGELOG gets release entries from main AND beta entries here — keep both.
+CHANGELOG.md merge=union
\ No newline at end of file
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bde953cf6..0f1be80fd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -45,15 +45,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9f6beedf4..da0008715 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,4 +31,4 @@ jobs:
 
       - run: ./gradlew testReleaseUnitTest jacocoTestReleaseUnitTestReport lintRelease --continue --console=plain
 
-      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # pin@7.0.0
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # pin@7.1.1
diff --git a/EXAMPLES.md b/EXAMPLES.md
index de8539d1a..575591ca7 100644
--- a/EXAMPLES.md
+++ b/EXAMPLES.md
@@ -11,6 +11,7 @@ Each topic lives in its own file under [`examples/`](examples).
 - [Ephemeral Browsing](examples/ephemeral-browsing.md)
 - [Auth Tab](examples/auth-tab.md)
 - [DPoP](examples/dpop.md)
+- [Experiment Center](examples/experiment-center.md)
 - [Handling Configuration Changes During Authentication](examples/configuration-changes.md)
 
 ## Authentication API
diff --git a/build.gradle b/build.gradle
index 7f94c35eb..eac37a087 100644
--- a/build.gradle
+++ b/build.gradle
@@ -42,4 +42,18 @@ allprojects {
         google()
         mavenCentral()
     }
+
+    // Patch vulnerable transitive deps to clear the reported CVEs. Pulled in by test
+    // tooling (netty-codec-http via AGP/grpc-netty, bcprov-jdk18on via Robolectric);
+    // not included in the published AAR.
+    configurations.configureEach {
+        resolutionStrategy.eachDependency { details ->
+            if (details.requested.group == 'io.netty' && details.requested.name == 'netty-codec-http') {
+                details.useVersion '4.1.137.Final'
+            }
+            if (details.requested.group == 'org.bouncycastle' && details.requested.name == 'bcprov-jdk18on') {
+                details.useVersion '1.85'
+            }
+        }
+    }
 }
diff --git a/examples/experiment-center.md b/examples/experiment-center.md
new file mode 100644
index 000000000..2096ef9eb
--- /dev/null
+++ b/examples/experiment-center.md
@@ -0,0 +1,54 @@
+# Experiment Center
+
+[Experiment Center](https://auth0.com/docs/customize/experiment-center/overview) is Auth0's A/B testing platform for authentication flows. It lets you split traffic across variants, measure results, and promote the winner — all inside Auth0.
+
+Pass `experiment_id`, `variation_id`, and optionally `segment_id` via `withParameters()` to force a user into a specific variation for the login request, bypassing the server-side deterministic assignment. All three IDs are obtained from your Auth0 Dashboard or the Management API:
+
+- `experiment_id` — the ID of the experiment to target
+- `variation_id` — the specific variation to assign to this user
+- `segment_id` — _(optional)_ restricts the override to a particular audience segment within the experiment
+
+```kotlin
+WebAuthProvider.login(account)
+    .withParameters(mapOf(
+        "experiment_id" to "<EXPERIMENT_ID>",
+        "variation_id" to "<VARIATION_ID>",
+        "segment_id" to "<SEGMENT_ID>"       // optional
+    ))
+    .start(this, callback)
+```
+
+<details>
+  <summary>Using coroutines</summary>
+
+```kotlin
+WebAuthProvider.login(account)
+    .withParameters(mapOf(
+        "experiment_id" to "<EXPERIMENT_ID>",
+        "variation_id" to "<VARIATION_ID>",
+        "segment_id" to "<SEGMENT_ID>"       // optional
+    ))
+    .await(this)
+```
+
+</details>
+
+<details>
+  <summary>Using Java</summary>
+
+```java
+WebAuthProvider.login(account)
+    .withParameters(new HashMap<String, Object>() {{
+        put("experiment_id", "<EXPERIMENT_ID>");
+        put("variation_id", "<VARIATION_ID>");
+        put("segment_id", "<SEGMENT_ID>");   // optional
+    }})
+    .start(this, callback);
+```
+
+</details>
+
+> [!NOTE]
+> Experiment Center is an Enterprise feature, and support via SDKs is currently in Early Access. To request access to this feature, contact your Auth0 representative. The override only applies to the current request — the next login without these parameters reverts to server-side deterministic assignment. Refer to the [Experiment Center documentation](https://auth0.com/docs/customize/experiment-center/overview) for setup instructions.
+>
+> Only `WebAuthProvider` login reaches Experiment Center. Embedded/native login and ROPG skip `/authorize` entirely and do not support experiment overrides.