diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index c3d9b7d29..dc0f79327 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -68,6 +68,8 @@ jobs:
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
       uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      env:
+        MAVEN_ARGS: -Puse-apache-snapshots
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index c42810878..826dc7c9d 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -54,4 +54,4 @@ jobs:
         distribution: 'temurin'
         java-version: ${{ matrix.java }}
     - name: Build with Maven
-      run: mvn --errors --show-version --batch-mode --no-transfer-progress -Ddoclint=none
+      run: mvn --errors --show-version --batch-mode --no-transfer-progress -Ddoclint=none -Puse-apache-snapshots
diff --git a/commons-digester3-core/pom.xml b/commons-digester3-core/pom.xml
index 763cd337c..9947a09be 100644
--- a/commons-digester3-core/pom.xml
+++ b/commons-digester3-core/pom.xml
@@ -34,6 +34,11 @@
   <name>Apache Commons Digester :: Core</name>
 
   <dependencies>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-secure-xml</artifactId>
+      <version>1.0.0-SNAPSHOT</version>
+    </dependency>
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib</artifactId>
diff --git a/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java b/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java
index 5aa17f36f..dc8a7781a 100644
--- a/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java
+++ b/commons-digester3-core/src/main/java/org/apache/commons/digester3/Digester.java
@@ -48,6 +48,7 @@
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.apache.commons.xml.secure.SecureSAXParserFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.ContentHandler;
 import org.xml.sax.EntityResolver;
@@ -1589,7 +1590,7 @@ public SAXParserFactory getFactory()
     {
         if ( factory == null )
         {
-            factory = SAXParserFactory.newInstance();
+            factory = SecureSAXParserFactory.newInstance();
             factory.setNamespaceAware( namespaceAware );
             factory.setXIncludeAware( xincludeAware );
             factory.setValidating( validating );
diff --git a/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java b/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java
index 87bd7ef21..7882fab47 100644
--- a/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java
+++ b/commons-digester3-core/src/main/java/org/apache/commons/digester3/NodeCreateRule.java
@@ -23,6 +23,7 @@
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.w3c.dom.Attr;
 import org.w3c.dom.DOMException;
 import org.w3c.dom.Document;
@@ -335,7 +336,7 @@ public NodeCreateRule( final DocumentBuilder documentBuilder )
     public NodeCreateRule( final int nodeType )
         throws ParserConfigurationException
     {
-        this( nodeType, DocumentBuilderFactory.newInstance().newDocumentBuilder() );
+        this( nodeType, SecureDocumentBuilderFactory.newInstance().newDocumentBuilder() );
     }
 
     /**
diff --git a/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java b/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java
index 0fa0c2069..8cf5cd20e 100644
--- a/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java
+++ b/commons-digester3-core/src/main/java/org/apache/commons/digester3/binder/DigesterLoader.java
@@ -43,6 +43,7 @@
 import org.apache.commons.digester3.RulesBase;
 import org.apache.commons.digester3.StackAction;
 import org.apache.commons.digester3.Substitutor;
+import org.apache.commons.xml.secure.SecureSAXParserFactory;
 import org.xml.sax.EntityResolver;
 import org.xml.sax.ErrorHandler;
 import org.xml.sax.Locator;
@@ -107,7 +108,7 @@ public static DigesterLoader newLoader( final RulesModule... rulesModules )
     /**
      * The SAXParserFactory to create new default {@link Digester} instances.
      */
-    private final SAXParserFactory factory = SAXParserFactory.newInstance();
+    private final SAXParserFactory factory = SecureSAXParserFactory.newInstance();
 
     private final Iterable<RulesModule> rulesModules;
 
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 241d9c42e..303c6de7c 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -27,6 +27,9 @@
     <action dev="simonetripodi" type="add" issue="DIGESTER-171" due-to="Nick Williams, Ivan Diana">Add DefaultThrowingErrorHandler to Digester API.</action>
     <action dev="ggregory" type="add" due-to="Gary Gregory">Add Maven property project.build.outputTimestamp for build reproducibility.</action>
     <!--  FIX -->
+    <action dev="pkarwasz" type="fix">
+      Create SAX parser and document builder factories through org.apache.commons:commons-secure-xml, which bounds entity expansion and enables XML secure processing.
+    </action>
     <action dev="simonetripodi" type="fix" issue="DIGESTER-175">
       Regression: DigesterTestCase#testPopNamedStackNotPushed expects EmptyStackException.
     </action>