diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index a62fb4c..3e52dfd 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -19,9 +19,9 @@ jobs:
       github.event_name == 'workflow_dispatch' }}
     uses: simplify9/.github/.github/workflows/reusable-service-cicd.yml@main
     with:
-      major-version: '8'
+      major-version: '10'
       minor-version: '0'
-      dotnet-version: '8.0.x'
+      dotnet-version: '10.0.x'
 
       # Build + push the SDK NuGet package (tests off, as before)
       nuget-projects: 'SW.Surl.Sdk/SW.Surl.Sdk.csproj'
diff --git a/Dockerfile b/Dockerfile
index f156c70..48ca949 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,11 @@
-FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
 WORKDIR /app
 # .NET 8+ listens on 8080 by default; the surl Helm chart sends traffic to containerPort 80.
 ENV ASPNETCORE_HTTP_PORTS=80
 EXPOSE 80
 EXPOSE 443
 
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 WORKDIR /src
 COPY ["SW.Surl.Web/SW.Surl.Web.csproj", "SW.Surl.Web/"]
 COPY ["SW.Surl.Sdk/SW.Surl.Sdk.csproj", "SW.Surl.Sdk/"]
diff --git a/SW.Surl.Sdk/SW.Surl.Sdk.csproj b/SW.Surl.Sdk/SW.Surl.Sdk.csproj
index ef05a3b..71bc335 100644
--- a/SW.Surl.Sdk/SW.Surl.Sdk.csproj
+++ b/SW.Surl.Sdk/SW.Surl.Sdk.csproj
@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <PackageId>SimplyWorks.Surl.Sdk</PackageId>
     <Authors>SimplyWorks</Authors>
     <Product>SimplyWorks.Surl.Sdk</Product>
@@ -9,7 +9,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Abstractions" Version="2.3.0" />
-    <PackageReference Include="SimplyWorks.HttpExtensions" Version="8.0.0" />
+    <PackageReference Include="SimplyWorks.HttpExtensions" Version="8.1.1" />
   </ItemGroup>
 
 </Project>
diff --git a/SW.Surl.Web/SW.Surl.Web.csproj b/SW.Surl.Web/SW.Surl.Web.csproj
index 5f7d74c..ad4d826 100644
--- a/SW.Surl.Web/SW.Surl.Web.csproj
+++ b/SW.Surl.Web/SW.Surl.Web.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
   </PropertyGroup>
 
   <ItemGroup>
@@ -8,16 +8,16 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.20">
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.11" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.20" />
-    <PackageReference Include="EFCore.NamingConventions" Version="8.0.3" />
-    <PackageReference Include="FluentValidation" Version="12.0.0" />
-    <PackageReference Include="SimplyWorks.CqApi" Version="8.2.3" />
-    <PackageReference Include="SimplyWorks.EfCoreExtensions" Version="8.1.0" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
+    <PackageReference Include="EFCore.NamingConventions" Version="10.0.1" />
+    <PackageReference Include="FluentValidation" Version="12.1.1" />
+    <PackageReference Include="SimplyWorks.CqApi" Version="10.0.0" />
+    <PackageReference Include="SimplyWorks.EfCoreExtensions" Version="10.0.1" />
     <PackageReference Include="SimplyWorks.Logger" Version="8.0.1" />
     
   </ItemGroup>
diff --git a/SW.Surl.Web/Startup.cs b/SW.Surl.Web/Startup.cs
index 063b6e5..7b857a6 100644
--- a/SW.Surl.Web/Startup.cs
+++ b/SW.Surl.Web/Startup.cs
@@ -2,6 +2,7 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
@@ -52,6 +53,11 @@ public void ConfigureServices(IServiceCollection services)
             services.AddDbContext<SurlDbContext>(c =>
             {
                 c.EnableSensitiveDataLogging(true);
+                // created_on is timestamp without time zone in the database but the model maps DateTime
+                // to timestamptz (Npgsql 6+), which EF 8 ignored and EF 9+ reports as a pending change and
+                // throws on in Migrate(). Pinning the column type would make Npgsql refuse the UTC
+                // CreatedOn values the audit writes, so keep EF 8's behaviour.
+                c.ConfigureWarnings(w => w.Ignore(RelationalEventId.PendingModelChangesWarning));
                 c.UseSnakeCaseNamingConvention();
                 c.UseNpgsql(Configuration.GetConnectionString(SurlDbContext.ConnectionString), b =>
                 {
@@ -79,6 +85,7 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
             app.UseEndpoints(endpoints =>
             {
                 endpoints.MapControllers();
+                endpoints.MapCqApi();
             });
         }
     }