diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 452fd72..2a15683 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   kotlin-wasm-compiler-compatibility:
-    name: Kotlin/Wasm compilers 2.4.0 and 2.3.21
+    name: Kotlin/Wasm compilers 2.4.10 and 2.3.21
     runs-on: ubuntu-24.04
     timeout-minutes: 60
 
diff --git a/README.md b/README.md
index 5f65178..1eff4ef 100644
--- a/README.md
+++ b/README.md
@@ -351,7 +351,7 @@ a bounded, caller-scoped pending table and copied into guest memory exactly
 once. Linked `wasmJs` and `wasmWasi` binaries verify the compiler-facing
 contract, and the `wasmWasi` binary is decoded, validated, instantiated, and
 executed by kwasm in the JVM compatibility test. The compiler gate builds the
-same pinned corpus with Kotlin `2.4.0` and previous stable `2.3.21`, in both
+same pinned corpus with Kotlin `2.4.10` and previous stable `2.3.21`, in both
 legacy and standardized exception-handling modes. Every row exercises WASI
 hello-world/stdlib behavior, a JSON round-trip, exception-heavy control flow,
 and the generated bindgen boundary; see
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index cc4bbee..18b6693 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -2,9 +2,9 @@
 agp = "9.3.0-alpha01"
 benchmark = "0.4.17"
 coroutines = "1.10.2"
-kotlin = "2.4.0"
+kotlin = "2.4.10"
 kotlinx-io = "0.9.1"
-ksp = "2.3.9"
+ksp = "2.3.10"
 serialization = "1.11.0"
 
 [libraries]
diff --git a/scripts/verify-kotlin-wasm-compiler-compatibility.sh b/scripts/verify-kotlin-wasm-compiler-compatibility.sh
index 8447a1e..3cf3d91 100644
--- a/scripts/verify-kotlin-wasm-compiler-compatibility.sh
+++ b/scripts/verify-kotlin-wasm-compiler-compatibility.sh
@@ -2,10 +2,10 @@
 
 set -euo pipefail
 
-# Kotlin's official release history lists 2.4.0 as the current line and
+# Kotlin's official release history lists 2.4.10 as the current line and
 # 2.3.21 as the previous stable bug-fix release:
 # https://kotlinlang.org/docs/releases.html#release-history
-readonly CURRENT_KOTLIN_VERSION="2.4.0"
+readonly CURRENT_KOTLIN_VERSION="2.4.10"
 readonly PREVIOUS_KOTLIN_VERSION="2.3.21"
 readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 readonly REPOSITORY_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
diff --git a/wasm-bindgen-api/build.gradle.kts b/wasm-bindgen-api/build.gradle.kts
index 8031d4c..433d653 100644
--- a/wasm-bindgen-api/build.gradle.kts
+++ b/wasm-bindgen-api/build.gradle.kts
@@ -8,7 +8,7 @@ plugins {
     alias(libs.plugins.kotlin.multiplatform)
     alias(libs.plugins.android.kotlin.multiplatform.library)
     alias(libs.plugins.kotlin.serialization)
-    id("com.google.devtools.ksp") version "2.3.9"
+    id("com.google.devtools.ksp") version "2.3.10"
     `maven-publish`
 }
 
diff --git a/wasm-bindgen-runtime/KOTLIN_WASM_COMPATIBILITY.md b/wasm-bindgen-runtime/KOTLIN_WASM_COMPATIBILITY.md
index d235bf1..96844e5 100644
--- a/wasm-bindgen-runtime/KOTLIN_WASM_COMPATIBILITY.md
+++ b/wasm-bindgen-runtime/KOTLIN_WASM_COMPATIBILITY.md
@@ -6,7 +6,7 @@ module, rather than a hand-authored fixture. The required gate follows the
 
 | Compiler row | Binary source | Required execution |
 | --- | --- | --- |
-| Current (`2.4.0`) | `:bindgen-api` wasmWasi test executable from the working checkout | Decode, validate, instantiate, run the module start function and Kotlin test suite, then cross generated bindgen `begin`/`finish` imports |
+| Current (`2.4.10`) | `:bindgen-api` wasmWasi test executable from the working checkout | Decode, validate, instantiate, run the module start function and Kotlin test suite, then cross generated bindgen `begin`/`finish` imports |
 | Previous stable (`2.3.21`) | The exact same source fixture built in an isolated copied checkout | The identical JVM compatibility test |
 
 Run the complete local gate from the repository root:
@@ -18,7 +18,7 @@ bash scripts/verify-kotlin-wasm-compiler-compatibility.sh
 The script copies source inputs into a new `mktemp` directory, excludes
 checkout metadata and all build products, changes the Kotlin version catalog
 only in that disposable copy, and builds the previous row there. It then feeds
-the `2.3.21` binary into the current `2.4.0` runtime test. The source checkout
+the `2.3.21` binary into the current `2.4.10` runtime test. The source checkout
 is never rewritten. Set `KWASM_COMPAT_KEEP_WORK=1` to preserve the isolated
 copy for diagnosis.
 
@@ -29,7 +29,7 @@ The Gradle seam remains directly usable for a prebuilt row:
   --tests io.heapy.kwasm.bindgen.runtime.KotlinWasmCompilerCompatibilityTest \
   -Pkwasm.kotlinWasmCompatibilityBinaries=/path/to/2.3.21/kwasm-bindgen-api-test.wasm \
   -Pkwasm.kotlinWasmCompatibilityVersions=2.3.21 \
-  -Pkwasm.kotlinWasmCompatibilityRequiredVersions=2.4.0,2.3.21
+  -Pkwasm.kotlinWasmCompatibilityRequiredVersions=2.4.10,2.3.21
 ```
 
 Binary paths use the platform path separator; compiler labels and required
@@ -40,7 +40,7 @@ compiled from
 `wasm-bindgen-api/src/wasmWasiTest/kotlin/io/heapy/kwasm/bindgen/WasmCompilerFixture.kt`.
 After each full execution the test writes
 `KWASM_KOTLIN_WASM_COMPATIBILITY_PASS compiler=<version>` to its JUnit output.
-The local/CI gate independently requires both `2.4.0` and `2.3.21` markers, so
+The local/CI gate independently requires both `2.4.10` and `2.3.21` markers, so
 a missing, mislabeled, skipped, or unexecuted row fails.
 
 The corpus uses `ModuleValidationLimits(allowInertV128Types = true)`: current
diff --git a/wasm-bindgen-runtime/build.gradle.kts b/wasm-bindgen-runtime/build.gradle.kts
index 728a7b5..d6d5fcb 100644
--- a/wasm-bindgen-runtime/build.gradle.kts
+++ b/wasm-bindgen-runtime/build.gradle.kts
@@ -5,7 +5,7 @@ import org.gradle.api.tasks.testing.Test
 plugins {
     alias(libs.plugins.kotlin.multiplatform)
     alias(libs.plugins.android.kotlin.multiplatform.library)
-    id("com.google.devtools.ksp") version "2.3.9"
+    id("com.google.devtools.ksp") version "2.3.10"
     `maven-publish`
 }