diff --git a/build/versions.env b/build/versions.env
index 900ce57..f364268 100644
--- a/build/versions.env
+++ b/build/versions.env
@@ -1,7 +1,7 @@
 # Pinned versions. update-versions.sh proposes updates via PR.
 
-NGINX_STABLE_VERSION="1.30.4"
-NGINX_MAINLINE_VERSION="1.31.5"
+NGINX_STABLE_VERSION="1.30.5"
+NGINX_MAINLINE_VERSION="1.31.6"
 
 # OpenSSL 3.5: LTS, native PQC/ML-KEM.
 OPENSSL_VERSION="3.5.8"
@@ -18,8 +18,8 @@ CRS_VERSION="4.25.1"
 
 # SHA256 pins for every distributed source. Build reproducibility contract —
 # `git log build/versions.env` is the single audit surface.
-NGINX_STABLE_SHA256="4261dc90e9e47c1c4041276e9aaa3d48ebe2e664f728e14fa95ae6c67d57a08b"
-NGINX_MAINLINE_SHA256="e951607d534836624bd36b6b45a71dbfb055237deae3738da6bbf3270dada279"
+NGINX_STABLE_SHA256="6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11c4906d"
+NGINX_MAINLINE_SHA256="974ed5298a5e398e008704ed5db284e655fc270c596493dbccada452448fc9f1"
 OPENSSL_SHA256="a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2"
 PCRE2_SHA256="ebcc25aadf2a51fa1fefa9b8bc9e7a79b3dae86870a0f1152a22e42befd46888"
 HEADERS_MORE_SHA256="c14cb5e6c998590c209efbf77bd7637ce2cab02332e4192756a8af5b26ba4284"