diff --git a/src/Aspire.AppHost/Aspire.AppHost.csproj b/src/Aspire.AppHost/Aspire.AppHost.csproj
index 4fbe70cdcf..33c9cf9e71 100644
--- a/src/Aspire.AppHost/Aspire.AppHost.csproj
+++ b/src/Aspire.AppHost/Aspire.AppHost.csproj
@@ -18,6 +18,7 @@
     <!-- Force the transitive MessagePack (via Aspire.Hosting/KubernetesClient) up to a
          patched version to resolve NU1903 (GHSA-hv8m-jj95-wg3x). -->
     <PackageReference Include="MessagePack" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Auth/Azure.DataApiBuilder.Auth.csproj b/src/Auth/Azure.DataApiBuilder.Auth.csproj
index 3a34ee30c0..50fe843452 100644
--- a/src/Auth/Azure.DataApiBuilder.Auth.csproj
+++ b/src/Auth/Azure.DataApiBuilder.Auth.csproj
@@ -17,6 +17,7 @@
     <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" />
     <PackageReference Include="Microsoft.AspNetCore.Http" />
     <PackageReference Include="System.Drawing.Common" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Azure.DataApiBuilder.Mcp/Azure.DataApiBuilder.Mcp.csproj b/src/Azure.DataApiBuilder.Mcp/Azure.DataApiBuilder.Mcp.csproj
index d94afa06b0..b1a3ae496a 100644
--- a/src/Azure.DataApiBuilder.Mcp/Azure.DataApiBuilder.Mcp.csproj
+++ b/src/Azure.DataApiBuilder.Mcp/Azure.DataApiBuilder.Mcp.csproj
@@ -34,6 +34,7 @@
   <ItemGroup>
     <PackageReference Include="ModelContextProtocol" />
     <PackageReference Include="ModelContextProtocol.AspNetCore" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Cli.Tests/Cli.Tests.csproj b/src/Cli.Tests/Cli.Tests.csproj
index 1d9c1e83f0..3c4a53f2e0 100644
--- a/src/Cli.Tests/Cli.Tests.csproj
+++ b/src/Cli.Tests/Cli.Tests.csproj
@@ -24,6 +24,7 @@
         <PackageReference Include="MSTest.TestFramework" />
         <PackageReference Include="Newtonsoft.Json" />
         <PackageReference Include="System.IO.Abstractions.TestingHelpers" />
+        <PackageReference Include="System.Security.Cryptography.Pkcs" />
         <PackageReference Include="Verify.MSTest" />
         <PackageReference Include="Verify.DiffPlex" />
     </ItemGroup>
diff --git a/src/Cli/Cli.csproj b/src/Cli/Cli.csproj
index 98b6151296..7aab7988e7 100644
--- a/src/Cli/Cli.csproj
+++ b/src/Cli/Cli.csproj
@@ -35,6 +35,7 @@
   <ItemGroup>
     <PackageReference Include="CommandLineParser" />
     <PackageReference Include="System.IO.Abstractions" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="HotChocolate.Utilities.Introspection" />
   </ItemGroup>
 
diff --git a/src/Config/Azure.DataApiBuilder.Config.csproj b/src/Config/Azure.DataApiBuilder.Config.csproj
index 0d1655df76..1f145787fd 100644
--- a/src/Config/Azure.DataApiBuilder.Config.csproj
+++ b/src/Config/Azure.DataApiBuilder.Config.csproj
@@ -22,6 +22,7 @@
       <PackageReference Include="Serilog.Sinks.File" />
       <PackageReference Include="System.IO.Abstractions" />
       <PackageReference Include="System.Drawing.Common" />
+      <PackageReference Include="System.Security.Cryptography.Pkcs" />
       <PackageReference Include="Microsoft.Data.SqlClient" />
       <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
       <PackageReference Include="System.IdentityModel.Tokens.Jwt" />
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index afa9d3e276..1c596e4bf3 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -33,8 +33,8 @@
     <PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.38.1" />
     <PackageVersion Include="Microsoft.Azure.StackExchangeRedis" Version="3.3.1" />
     <!-- Pinned to override the vulnerable MessagePack 2.5.192 pulled in transitively
-         by Aspire.Hosting (KubernetesClient). 2.5.301 patches GHSA-hv8m-jj95-wg3x / CVE-2026-48109. -->
-    <PackageVersion Include="MessagePack" Version="2.5.301" />
+         by Aspire.Hosting (KubernetesClient). 2.5.301 >= patches GHSA-hv8m-jj95-wg3x / CVE-2026-48109. -->
+    <PackageVersion Include="MessagePack" Version="2.5.307" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Primitives" Version="10.0.0" />
@@ -58,8 +58,8 @@
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
     <PackageVersion Include="Microsoft.OData.Edm" Version="7.20.0" />
     <PackageVersion Include="Microsoft.OData.Core" Version="7.20.0" />
-    <PackageVersion Include="Microsoft.OpenApi" Version="1.6.14" />
-    <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.14" />
+    <PackageVersion Include="Microsoft.OpenApi" Version="1.6.31" />
+    <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.31" />
     <PackageVersion Include="Moq" Version="4.18.2" />
     <PackageVersion Include="MSTest.TestAdapter" Version="3.3.1" />
     <PackageVersion Include="MSTest.TestFramework" Version="3.3.1" />
@@ -80,6 +80,7 @@
         <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.1.2" />
         <PackageVersion Include="System.IO.Abstractions" Version="21.0.2" />
         <PackageVersion Include="System.IO.Abstractions.TestingHelpers" Version="21.0.2" />
+        <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
         <PackageVersion Include="Verify.MsTest" Version="23.6.0" />
         <PackageVersion Include="Verify.DiffPlex" Version="2.3.0" />
         <PackageVersion Include="ZiggyCreatures.FusionCache" Version="2.1.0" />