diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 453634ddc..13b5f25c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1911,14 +1911,14 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2022.12.19'}
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '3.6.3'}
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '3.8.9'}
-          - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '4.0.0-rc-6'}
+          - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '4.0.0-rc-7'}
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build, jvm_tool: maven, maven: '3.9.3'}
           - {os: ubuntu-latest, suite: e2e_redirect_maven_build, jvm_tool: maven, maven: '3.9.4'}
           - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.6.3', test_filter: '--ignored maven_reactor'}
           - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.8.9', test_filter: '--ignored maven_reactor'}
           - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.9.2', test_filter: '--ignored maven_reactor'}
           - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.9.16', test_filter: '--ignored maven_reactor'}
-          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '4.0.0-rc-6', test_filter: '--ignored maven_reactor'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '4.0.0-rc-7', test_filter: '--ignored maven_reactor'}
           - {os: ubuntu-latest, suite: 'e2e_gradle_discovery_build e2e_gradle_agent_build e2e_redirect_gradle_build', jvm_tool: gradle, gradle: '6.9.4', java: '11', test_filter: '--ignored gradle_agent_ gradle_hosted_3 gradle_hosted_4 gradle_hosted_5'}
           - {os: ubuntu-latest, suite: e2e_redirect_gradle_build, jvm_tool: gradle, gradle: '6.9.4', java: '11', test_filter: '--ignored gradle_hosted_b gradle_hosted_c gradle_hosted_d gradle_hosted_e gradle_hosted_f gradle_hosted_l gradle_hosted_m gradle_hosted_n gradle_hosted_o gradle_hosted_p'}
           - {os: ubuntu-latest, suite: e2e_redirect_gradle_build, jvm_tool: gradle, gradle: '6.9.4', java: '11', test_filter: '--ignored gradle_hosted_ --skip gradle_hosted_3 --skip gradle_hosted_4 --skip gradle_hosted_5 --skip gradle_hosted_b --skip gradle_hosted_c --skip gradle_hosted_d --skip gradle_hosted_e --skip gradle_hosted_f --skip gradle_hosted_l --skip gradle_hosted_m --skip gradle_hosted_n --skip gradle_hosted_o --skip gradle_hosted_p'}
diff --git a/crates/socket-patch-cli/tests/maven_build_common/mod.rs b/crates/socket-patch-cli/tests/maven_build_common/mod.rs
index a49bc96fc..5eca098ce 100644
--- a/crates/socket-patch-cli/tests/maven_build_common/mod.rs
+++ b/crates/socket-patch-cli/tests/maven_build_common/mod.rs
@@ -34,7 +34,7 @@ pub const MVN_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_MVN";
 pub const VERSION_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_VERSION";
 pub const REQUIRED_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_REQUIRED";
 
-/// What Maven 4's `CIDetector`s key on (4.0.0-rc-6 `cisupport`: generic
+/// What Maven 4's `CIDetector`s key on (4.0.0-rc-7 `cisupport`: generic
 /// `CI`, GitHub `GITHUB_ACTIONS`, CircleCI, Jenkins `WORKSPACE`, TeamCity,
 /// Travis). When one is set, Maven 4 swaps in the `QuietMavenTransferListener`
 /// even under `-B` — no "Downloading from …" lines and, crucially, no
diff --git a/crates/socket-patch-core/src/vex/discover/maven.rs b/crates/socket-patch-core/src/vex/discover/maven.rs
index bac874a30..c826edf51 100644
--- a/crates/socket-patch-core/src/vex/discover/maven.rs
+++ b/crates/socket-patch-core/src/vex/discover/maven.rs
@@ -1547,7 +1547,7 @@ mod tests {
 
     /// REGRESSION: the vendored repository is `checksumPolicy=fail`, so the
     /// jar's `.sha1` sidecar is part of the wiring. With it stale or gone,
-    /// real Maven (3.6.3 → 4.0.0-rc-6, `e2e_vendor_maven_build`) rejects the
+    /// real Maven (3.6.3 → 4.0.0-rc-7, `e2e_vendor_maven_build`) rejects the
     /// file:// copy and silently resolves Central's pristine jar — while the
     /// committed members still hash-verify, so the ref must not attest a
     /// build that no longer consumes the patch.
diff --git a/docs/design/maven-vendoring.md b/docs/design/maven-vendoring.md
index 658eed563..432789057 100644
--- a/docs/design/maven-vendoring.md
+++ b/docs/design/maven-vendoring.md
@@ -248,11 +248,12 @@ integration tests. Real-tool capstones exercise a Maven reactor from fresh
 checkouts, root and module invocations, Gradle strict locking and repository
 mode, existing verification metadata, offline builds, tamper detection and
 byte-exact revert; `e2e_vendor_gradle_build` covers each Gradle rule above
-against a fake Central, asserting on the jar Gradle actually consumes. The PR
-tier pins Maven 3.6.3, 3.8.9, 3.9.2, 3.9.16 and 4.0.0-rc-6 (macOS and Windows on
-3.9.16), and Gradle 6.9.4, 7.6.6, 8.14.3 and 9.8.0 on Linux, plus a Windows
-8.14.3 row; `gradle-compatibility.yml` runs every Gradle version on Linux,
-macOS and Windows nightly.
+against a fake Central, asserting on the jar Gradle actually consumes. PR and
+merge-queue runs pin Maven 3.9.16; the nightly full tier adds 3.6.3, 3.8.9,
+3.9.2, 3.9.3, 3.9.4 and 4.0.0-rc-7 (macOS and Windows on 3.9.16), and Gradle
+6.9.4, 7.6.6, 8.14.3 and 9.8.0 on Linux, plus a Windows 8.14.3 row;
+`gradle-compatibility.yml` runs every Gradle version on Linux, macOS and
+Windows nightly.
 
 Pre-v5 single-POM entries are not migrated: revert them and vendor again.
 Maven 4 implicit subproject discovery, build-time Maven strict pins, creating Gradle verification policy, and online
diff --git a/scripts/maven-sha512.json b/scripts/maven-sha512.json
index 066ab5605..8ede34e22 100644
--- a/scripts/maven-sha512.json
+++ b/scripts/maven-sha512.json
@@ -5,5 +5,5 @@
   "3.9.3": "400fc5b6d000c158d5ee7937543faa06b6bda8408caa2444a9c947c21472fde0f0b64ac452b8cec8855d528c0335522ed5b6c8f77085811c7e29e1bedbb5daa2",
   "3.9.4": "deaa39e16b2cf20f8cd7d232a1306344f04020e1f0fb28d35492606f647a60fe729cc40d3cba33e093a17aed41bd161fe1240556d0f1b80e773abd408686217e",
   "3.9.16": "831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6",
-  "4.0.0-rc-6": "3fba58e1c345a5aa1dbacfa7aceaf7b1a0fa9626e368eec4814fa7a7ebf0fe74f0e41481faef77f95d8738f9c1365f918c8b8c94d7c28656f067db61a8af7f2e"
+  "4.0.0-rc-7": "17b886c0ffb7ec225e514afa8179b3143d855d196cfbb4607ece6272a9b4f51501a389438ab6841b393a4b1391a1b714f07f450daba1951f53f732b400338184"
 }