diff --git a/gradle.properties b/gradle.properties
index 278db777ec..06ab5786ec 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -98,7 +98,7 @@ apacheDirectoryVersion=2.1.7
 apacheMinaVersion=2.2.4
 
 # Usually matches the version specified as a Spring Boot dependency (see springBootVersion below)
-apacheTomcatVersion=10.1.50
+apacheTomcatVersion=11.0.15
 
 # (mothership) -> json-path -> json-smart -> accessor-smart
 # (core) -> graalvm
@@ -274,7 +274,7 @@ rforgeVersion=0.6-8.1
 romeVersion=2.1.0
 
 # Tomcat 10 implements 6.x
-servletApiVersion=6.0.0
+servletApiVersion=6.1.0
 
 # this version is forced for compatibility with pipeline and tika
 slf4jLog4j12Version=2.0.17
@@ -285,9 +285,9 @@ slf4jLog4jApiVersion=2.0.17
 snappyJavaVersion=1.1.10.8
 
 # Also, update apacheTomcatVersion above to match Spring Boot's Tomcat dependency version
-springBootVersion=3.5.8
+springBootVersion=4.0.1
 # This usually matches the Spring Framework version dictated by springBootVersion
-springVersion=6.2.15
+springVersion=7.0.2
 
 sqliteJdbcVersion=3.51.1.0
 
diff --git a/server/embedded/build.gradle b/server/embedded/build.gradle
index 588653ff18..b6c017e846 100644
--- a/server/embedded/build.gradle
+++ b/server/embedded/build.gradle
@@ -71,11 +71,6 @@ dependencies {
             strictly "${springVersion}"
         }
     }
-    implementation('org.springframework:spring-jcl') {
-        version {
-            strictly "${springVersion}"
-        }
-    }
     implementation('org.springframework:spring-web') {
         version {
             strictly "${springVersion}"
diff --git a/server/embedded/src/org/labkey/embedded/LabKeyServer.java b/server/embedded/src/org/labkey/embedded/LabKeyServer.java
index 253ff2996d..177a4a64b6 100644
--- a/server/embedded/src/org/labkey/embedded/LabKeyServer.java
+++ b/server/embedded/src/org/labkey/embedded/LabKeyServer.java
@@ -7,7 +7,7 @@
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.boot.context.ApplicationPidFileWriter;
 import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
+import org.springframework.boot.tomcat.servlet.TomcatServletWebServerFactory;
 import org.springframework.boot.web.server.WebServerFactoryCustomizer;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -193,7 +193,7 @@ public TomcatServletWebServerFactory servletContainerFactory()
             Connector httpConnector = new Connector();
             httpConnector.setScheme("http");
             httpConnector.setPort(contextProperties.getHttpPort());
-            result.addAdditionalTomcatConnectors(httpConnector);
+            result.addAdditionalConnectors(httpConnector);
         }
 
         return result;
diff --git a/server/embedded/src/org/labkey/embedded/LabKeyTomcatServletWebServerFactory.java b/server/embedded/src/org/labkey/embedded/LabKeyTomcatServletWebServerFactory.java
index 593a08a687..ba31b633ef 100644
--- a/server/embedded/src/org/labkey/embedded/LabKeyTomcatServletWebServerFactory.java
+++ b/server/embedded/src/org/labkey/embedded/LabKeyTomcatServletWebServerFactory.java
@@ -14,8 +14,8 @@
 import org.apache.logging.log4j.Logger;
 import org.apache.tomcat.util.descriptor.web.ContextResource;
 import org.labkey.bootstrap.ConfigException;
-import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
-import org.springframework.boot.web.embedded.tomcat.TomcatWebServer;
+import org.springframework.boot.tomcat.TomcatWebServer;
+import org.springframework.boot.tomcat.servlet.TomcatServletWebServerFactory;
 import org.springframework.boot.web.servlet.ServletContextInitializer;
 
 import javax.sql.DataSource;
@@ -72,7 +72,7 @@ public LabKeyTomcatServletWebServerFactory(LabKeyServer server)
     protected void prepareContext(Host host, ServletContextInitializer[] initializers)
     {
         // Prevent the Spring Boot webapp from trying to deserialize the LabKey sessions
-        getSession().setPersistent(false);
+        getSettings().getSession().setPersistent(false);
 
         // Don't use Spring Boot's error pages, as we want to render our own
         setErrorPages(Collections.emptySet());
@@ -121,7 +121,7 @@ protected TomcatWebServer getTomcatWebServer(Tomcat tomcat)
                 setRegisterDefaultServlet(false);
 
                 // We want the LK webapp to serialize/deserialize sessions during restarts
-                getSession().setPersistent(true);
+                getSettings().getSession().setPersistent(true);
 
                 // Spring Boot's webapp is being deployed to the root. We have to deploy elsewhere in this initial
                 // call, but can immediately swap it with the desired place
@@ -130,7 +130,7 @@ protected TomcatWebServer getTomcatWebServer(Tomcat tomcat)
                 context.setPath(contextProperties.getContextPath());
 
                 // Propagate standard Spring Boot properties such as the session timeout
-                configureContext(context, new ServletContextInitializer[0]);
+                configureContext(context, Collections.emptyList());
 
                 LabKeyServer.CSPFilterProperties cspFilterProperties = _server.cspSource();