diff --git a/src/Api/Api.csproj b/src/Api/Api.csproj
index 9cfc5b9..f9365a9 100644
--- a/src/Api/Api.csproj
+++ b/src/Api/Api.csproj
@@ -16,15 +16,15 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
     <!--
       Microsoft.AspNetCore.OpenApi 10.0.10 resolves Microsoft.OpenApi 2.0.0 transitively, and
       that version carries GHSA-v5pm-xwqc-g5wc. NuGet audit reports it, warnings are errors,
       and the build stops — which is the gate working. 2.7.5 is the first release without the
       advisory. Drop this line once the framework package resolves a patched version itself.
     -->
-    <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
-    <PackageReference Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.10">
+    <PackageReference Include="Microsoft.OpenApi" Version="3.10.0" />
+    <PackageReference Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.11">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
@@ -44,7 +44,7 @@
       shipped as its own package because of the Microsoft.IdentityModel.* dependency chain it
       carries.
     -->
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.11" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Application/Application.csproj b/src/Application/Application.csproj
index 155efb0..648003c 100644
--- a/src/Application/Application.csproj
+++ b/src/Application/Application.csproj
@@ -25,8 +25,8 @@
       still declare that it logs and that it can be registered; what writes the log and what
       builds the container stay outside.
     -->
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.11" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/Api.IntegrationTests/Api.IntegrationTests.csproj b/tests/Api.IntegrationTests/Api.IntegrationTests.csproj
index 216f42e..b5fb9ad 100644
--- a/tests/Api.IntegrationTests/Api.IntegrationTests.csproj
+++ b/tests/Api.IntegrationTests/Api.IntegrationTests.csproj
@@ -6,8 +6,8 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
-    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.11" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <!-- Testcontainers.PostgreSql pulls SSH.NET 2025.1.0 transitively (SSH port forwarding, unused
diff --git a/tests/Application.Tests/Application.Tests.csproj b/tests/Application.Tests/Application.Tests.csproj
index 7405de8..0d57921 100644
--- a/tests/Application.Tests/Application.Tests.csproj
+++ b/tests/Application.Tests/Application.Tests.csproj
@@ -11,8 +11,8 @@
       calling the behaviors directly: what this step decides is the order they wrap a handler
       in, and a behavior called on its own cannot be wrong about that.
     -->
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Logging" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Logging" Version="10.0.11" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />