diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3e536a6..ba88d42 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,8 +3,10 @@
 # Maven follows the parent a service's pom takes by relativePath, and that parent is vendored:
 # a bump written into the copy makes it differ from its release and the service-conventions job
 # refuses it. Everything the parent pins is therefore ignored here and bumped in the shared
-# repository, where `sh tests/run` holds this list to what the parent actually pins. Everything
-# a service declares for itself stays watched.
+# repository, where `sh tests/run` holds this list to what the parent actually pins. The same
+# holds for the other vendored files Dependabot reads: the Maven wrapper, whose version is the
+# runtime module's, and the actions the vendored workflow verify.yml uses. Everything a service
+# declares for itself stays watched.
 version: 2
 updates:
   - package-ecosystem: "maven"
@@ -25,11 +27,15 @@ updates:
       - dependency-name: "com.diffplug.spotless:spotless-maven-plugin"
       - dependency-name: "com.google.googlejavaformat:google-java-format"
       - dependency-name: "org.codehaus.mojo:exec-maven-plugin"
+      - dependency-name: "org.apache.maven:apache-maven"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    ignore:
+      - dependency-name: "actions/checkout"
+      - dependency-name: "actions/setup-java"
     groups:
       actions:
         patterns:
diff --git a/AGENTS.md b/AGENTS.md
index 7d0a15b..70843e4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,8 +11,8 @@ Shared conventions of the robertblust, guestgraph and companygraph organizations
 
 Everything below this block is this repository's own. `sh conventions/conventions-sync check` says whether the copy matches the release, `sync` brings it to the release the pin names, and `sh conventions/conventions-check` holds this repository's own Markdown to `WRITING.md`, and `sh conventions/conventions-format` to its one form, which `fix` writes. Edit a shared file in robertblust/conventions, never here.
 <!-- end conventions -->
-<!-- service-conventions · v0.11.0 -->
-The code-level rules of every guestgraph service on the Spring stack live in `service-conventions/`, vendored from guestgraph/service-conventions at the release `service-conventions.json` names: the parent build every `pom.xml` takes by path, the source rules, the architecture rules in `src/test/java/ServiceRulesTest.java`, the diagram script, the API generator `regen-api` that writes the one `openapi.yaml` the service serves from the sources named beside it, the workflow in `.github/workflows/verify.yml`, and this block. `sh service-conventions/service-conventions-sync check` says whether the copy matches the release, `sync` brings it to the release the pin names, and `sh service-conventions/service-conventions-check` says what of the list the service lacks. What every service has, whatever its stack, is `SERVICE.md` there. Edit a shared file in guestgraph/service-conventions, never here.
+<!-- service-conventions · v0.12.0 -->
+The code-level rules of every guestgraph service on the Spring stack live in `service-conventions/`, vendored from guestgraph/service-conventions at the release `service-conventions.json` names: the parent build every `pom.xml` takes by path, the source rules, the architecture rules in `src/test/java/ServiceRulesTest.java`, the diagram script, the API generator `regen-api` that writes the one `openapi.yaml` the service serves from the sources named beside it, the workflow in `.github/workflows/verify.yml`, the Maven wrapper, and this block. `sh service-conventions/service-conventions-sync check` says whether the copy matches the release, `sync` brings it to the release the pin names, and `sh service-conventions/service-conventions-check` says what of the list the service lacks. What every service has, whatever its stack, is `SERVICE.md` there. Edit a shared file in guestgraph/service-conventions, never here.
 <!-- end service-conventions -->
 
 # GuestGraph — working conventions
diff --git a/pom.xml b/pom.xml
index 807886b..a50066a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
   <parent>
     <groupId>io.guestgraph</groupId>
     <artifactId>service-parent</artifactId>
-    <version>0.11.0</version>
+    <version>0.12.0</version>
     <relativePath>service-conventions/pom.xml</relativePath>
   </parent>
 
diff --git a/service-conventions.json b/service-conventions.json
index 9bc3b44..c256214 100644
--- a/service-conventions.json
+++ b/service-conventions.json
@@ -1 +1 @@
-{ "repo": "guestgraph/service-conventions", "tag": "v0.11.0", "stack": "spring", "root": "io.guestgraph.engine", "scope": "tenantId", "schema": "engine", "jdbcClientAllowed": ["io.guestgraph.engine.resolution.TenantLock", "io.guestgraph.engine.config.LocalDevSeeder"] }
+{ "repo": "guestgraph/service-conventions", "tag": "v0.12.0", "stack": "spring", "root": "io.guestgraph.engine", "scope": "tenantId", "schema": "engine", "jdbcClientAllowed": ["io.guestgraph.engine.resolution.TenantLock", "io.guestgraph.engine.config.LocalDevSeeder"] }
diff --git a/service-conventions/AGENTS.md b/service-conventions/AGENTS.md
index 3b88429..f043383 100644
--- a/service-conventions/AGENTS.md
+++ b/service-conventions/AGENTS.md
@@ -1,3 +1,3 @@
-<!-- service-conventions · v0.11.0 -->
-The code-level rules of every guestgraph service on the Spring stack live in `service-conventions/`, vendored from guestgraph/service-conventions at the release `service-conventions.json` names: the parent build every `pom.xml` takes by path, the source rules, the architecture rules in `src/test/java/ServiceRulesTest.java`, the diagram script, the API generator `regen-api` that writes the one `openapi.yaml` the service serves from the sources named beside it, the workflow in `.github/workflows/verify.yml`, and this block. `sh service-conventions/service-conventions-sync check` says whether the copy matches the release, `sync` brings it to the release the pin names, and `sh service-conventions/service-conventions-check` says what of the list the service lacks. What every service has, whatever its stack, is `SERVICE.md` there. Edit a shared file in guestgraph/service-conventions, never here.
+<!-- service-conventions · v0.12.0 -->
+The code-level rules of every guestgraph service on the Spring stack live in `service-conventions/`, vendored from guestgraph/service-conventions at the release `service-conventions.json` names: the parent build every `pom.xml` takes by path, the source rules, the architecture rules in `src/test/java/ServiceRulesTest.java`, the diagram script, the API generator `regen-api` that writes the one `openapi.yaml` the service serves from the sources named beside it, the workflow in `.github/workflows/verify.yml`, the Maven wrapper, and this block. `sh service-conventions/service-conventions-sync check` says whether the copy matches the release, `sync` brings it to the release the pin names, and `sh service-conventions/service-conventions-check` says what of the list the service lacks. What every service has, whatever its stack, is `SERVICE.md` there. Edit a shared file in guestgraph/service-conventions, never here.
 <!-- end service-conventions -->
diff --git a/service-conventions/dependabot.yml b/service-conventions/dependabot.yml
index 3e536a6..ba88d42 100644
--- a/service-conventions/dependabot.yml
+++ b/service-conventions/dependabot.yml
@@ -3,8 +3,10 @@
 # Maven follows the parent a service's pom takes by relativePath, and that parent is vendored:
 # a bump written into the copy makes it differ from its release and the service-conventions job
 # refuses it. Everything the parent pins is therefore ignored here and bumped in the shared
-# repository, where `sh tests/run` holds this list to what the parent actually pins. Everything
-# a service declares for itself stays watched.
+# repository, where `sh tests/run` holds this list to what the parent actually pins. The same
+# holds for the other vendored files Dependabot reads: the Maven wrapper, whose version is the
+# runtime module's, and the actions the vendored workflow verify.yml uses. Everything a service
+# declares for itself stays watched.
 version: 2
 updates:
   - package-ecosystem: "maven"
@@ -25,11 +27,15 @@ updates:
       - dependency-name: "com.diffplug.spotless:spotless-maven-plugin"
       - dependency-name: "com.google.googlejavaformat:google-java-format"
       - dependency-name: "org.codehaus.mojo:exec-maven-plugin"
+      - dependency-name: "org.apache.maven:apache-maven"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    ignore:
+      - dependency-name: "actions/checkout"
+      - dependency-name: "actions/setup-java"
     groups:
       actions:
         patterns:
diff --git a/service-conventions/pom.xml b/service-conventions/pom.xml
index 96cb7d9..d7a473e 100644
--- a/service-conventions/pom.xml
+++ b/service-conventions/pom.xml
@@ -16,7 +16,7 @@
 
   <groupId>io.guestgraph</groupId>
   <artifactId>service-parent</artifactId>
-  <version>0.11.0</version>
+  <version>0.12.0</version>
   <packaging>pom</packaging>
   <name>GuestGraph service parent</name>
   <description>The Spring stack of every guestgraph service: platform, shared versions and the plugins that hold the source to the rules</description>
@@ -31,10 +31,10 @@
   <properties>
     <java.version>25</java.version>
     <testcontainers.version>2.0.5</testcontainers.version>
-    <archunit.version>1.5.0</archunit.version>
+    <archunit.version>1.5.1</archunit.version>
     <wiremock.version>3.13.2</wiremock.version>
     <maven-pmd-plugin.version>3.28.0</maven-pmd-plugin.version>
-    <spotless.version>3.10.2</spotless.version>
+    <spotless.version>3.10.3</spotless.version>
     <google-java-format.version>1.36.1</google-java-format.version>
     <exec-maven-plugin.version>3.6.4</exec-maven-plugin.version>
   </properties>
diff --git a/service-conventions/service-conventions-sync b/service-conventions/service-conventions-sync
index 7950ea0..ccc864e 100644
--- a/service-conventions/service-conventions-sync
+++ b/service-conventions/service-conventions-sync
@@ -10,8 +10,10 @@
 # SERVICE_CONVENTIONS_SOURCE overrides that with another base URL or a local directory that holds
 # the stack's directory, which is how the tests run offline. Beside service-conventions/ the sync
 # writes four files a build reads in a fixed place: the workflow, the rules test, the API
-# generator and the block of AGENTS.md after the family's block, and the shared runtime, the
-# package io.guestgraph.service every service carries as source. Needs sh, curl, awk, sed, and shasum or sha256sum.
+# generator and the block of AGENTS.md after the family's block, the shared runtime, the
+# package io.guestgraph.service every service carries as source, and the Maven wrapper the runtime
+# module builds with, so every service runs the one Maven the parent is tested on. Needs sh, curl,
+# awk, sed, and shasum or sha256sum.
 set -eu
 
 usage() { echo "usage: sh service-conventions/service-conventions-sync sync|check" >&2; exit 2; }
@@ -25,6 +27,7 @@ FILES="pom.xml pmd-ruleset.xml ServiceRulesTest.java RegenApi.java regen-er rege
 RUNTIME="Problems.java ServiceException.java ServiceExceptionHandler.java RequestSizeLimitFilter.java ApiDocsController.java BearerTokenFilter.java ServiceDefaults.java ServiceAutoConfiguration.java"
 RESOURCES="service-defaults.yaml META-INF/spring.factories META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports"
 RUNTIME_DIR=src/main/java/io/guestgraph/service
+WRAPPER=".mvn/wrapper/maven-wrapper.properties mvnw mvnw.cmd"
 OPEN_RE='^<!-- service-conventions · v[^ ]* -->$'
 CLOSE='<!-- end service-conventions -->'
 FAMILY_CLOSE='<!-- end conventions -->'
@@ -94,12 +97,15 @@ if [ "$cmd" = sync ]; then
   for f in $RUNTIME; do fetch "runtime/src/main/java/io/guestgraph/service/$f" "$RUNTIME_DIR/$f"; done
   mkdir -p src/main/resources/META-INF/spring
   for f in $RESOURCES; do fetch "runtime/src/main/resources/$f" "src/main/resources/$f"; done
+  mkdir -p .mvn/wrapper
+  for f in $WRAPPER; do fetch "runtime/$f" "$f"; done
+  chmod +x mvnw
   for f in $FILES; do
     place=$(place_of "$f"); [ -n "$place" ] || continue
     mkdir -p "$(dirname "$place")"; cp "$DIR/$f" "$place"
   done
   write_block
-  echo "✓ service-conventions: $DIR/, the workflows, the rules test and the AGENTS.md block are at $REPO@$TAG ($STACK)"
+  echo "✓ service-conventions: $DIR/, the workflows, the rules test, the Maven wrapper and the AGENTS.md block are at $REPO@$TAG ($STACK)"
   exit 0
 fi
 
@@ -128,6 +134,12 @@ for f in $RUNTIME; do
     echo "✗ service-conventions: $RUNTIME_DIR/$f differs from $TAG"; status=1
   fi
 done
+for f in $WRAPPER; do
+  mkdir -p "$TMP/$(dirname "$f")"; fetch "runtime/$f" "$TMP/$f"
+  if [ ! -f "$f" ] || [ "$(sha "$f")" != "$(sha "$TMP/$f")" ]; then
+    echo "✗ service-conventions: $f differs from $TAG"; status=1
+  fi
+done
 if [ ! -f AGENTS.md ] || [ "$(block_of AGENTS.md)" != "$(block_of "$TMP/AGENTS.md")" ]; then
   echo "✗ service-conventions: the AGENTS.md block differs from $TAG"; status=1
 fi