diff --git a/Directory.Packages.props b/Directory.Packages.props
index e26d166..cda8efa 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -158,5 +158,8 @@
          Forced via a direct PackageReference in FlowLedger.AppHost.csproj. -->
     <PackageVersion Include="MessagePack" Version="3.1.7" />
     <PackageVersion Include="MessagePack.Annotations" Version="3.1.7" />
+    <!-- GHSA-v5pm-xwqc-g5wc: Microsoft.OpenApi 2.0.0 has a high-severity vulnerability.
+         2.7.5 is the patched version. -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
   </ItemGroup>
 </Project>
diff --git a/src/FlowLedger.Api/FlowLedger.Api.csproj b/src/FlowLedger.Api/FlowLedger.Api.csproj
index 51a33e8..e5618ed 100644
--- a/src/FlowLedger.Api/FlowLedger.Api.csproj
+++ b/src/FlowLedger.Api/FlowLedger.Api.csproj
@@ -6,6 +6,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" />
+    <!-- Security override: pin Microsoft.OpenApi to 2.7.5 (GHSA-v5pm-xwqc-g5wc). -->
+    <PackageReference Include="Microsoft.OpenApi" />
     <PackageReference Include="FluentValidation" />
     <PackageReference Include="FluentValidation.DependencyInjectionExtensions" />
     <PackageReference Include="Quartz" />
diff --git a/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj b/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj
index af27c88..4299968 100644
--- a/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj
+++ b/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj
@@ -9,6 +9,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
+    <!-- Security override: pin Microsoft.OpenApi to 2.7.5 (GHSA-v5pm-xwqc-g5wc). -->
+    <PackageReference Include="Microsoft.OpenApi" />
     <PackageReference Include="coverlet.collector">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>