diff --git a/buildscripts/dependency-check-suppressions.xml b/buildscripts/dependency-check-suppressions.xml
index e05a8051c10..b50351ad23c 100644
--- a/buildscripts/dependency-check-suppressions.xml
+++ b/buildscripts/dependency-check-suppressions.xml
@@ -30,6 +30,29 @@
     </notes>
     <cve>CVE-2024-35255</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+      CVE-2026-33117 affects azure-security-keyvault-keys (fixed in 4.10.6), which we do not depend on.
+      NVD maps it to the generic cpe:2.3:a:microsoft:azure_sdk_for_java "up to (excluding) 4.10.6",
+      so it matches every com.azure artifact whose own (unrelated) version is below 4.10.6,
+      e.g. azure-core 1.58.1, azure-core-http-netty 1.16.5, azure-identity 1.18.3, azure-json 1.5.1.
+      Those version lines will never reach 4.10.6, so upgrading cannot clear this finding.
+      If azure-security-keyvault-keys is ever added as a dependency, revisit this suppression.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/com\.azure/(?!azure-security-keyvault-keys@).*$</packageUrl>
+    <cve>CVE-2026-33117</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+      azure-monitor-opentelemetry-autoconfigure is an Azure Java library, but dependency-check infers
+      cpe:2.3:a:opentelemetry:opentelemetry from its name. That CPE then matches OpenTelemetry
+      Go / .NET / C++ CVEs whose fixed versions happen to be higher than this artifact's version,
+      e.g. CVE-2026-39882 and CVE-2026-41178 (Go), CVE-2026-40894 and CVE-2026-41078 (.NET),
+      CVE-2026-44967 (C++). None of them apply to Java.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/com\.azure/azure-monitor-opentelemetry-autoconfigure@.*$</packageUrl>
+    <cpe>cpe:2.3:a:opentelemetry:opentelemetry</cpe>
+  </suppress>
   <suppress>
     <notes>
       CVE-2023-35116 is not a valid CVE, see comment from library maintainer