diff --git a/Directory.Packages.props b/Directory.Packages.props
index 7f6ae85..cb15bac 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,8 +1,19 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <!-- Let a central PackageVersion override a transitive dependency's resolved
+         version without a direct PackageReference (see AngleSharp pin below). -->
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
 
+  <ItemGroup Label="Transitive security pins">
+    <!-- bUnit -> AngleSharp.Diffing pulls AngleSharp 1.4.0, which has a moderate
+         mXSS advisory (GHSA-pgww-w46g-26qg / CVE-2026-54570). Pin to the patched
+         1.5.x line to clear the CI vulnerability gate. Remove once bUnit ships a
+         transitive chain that resolves to >= 1.5.0 on its own (tracked in #97). -->
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
+  </ItemGroup>
+
   <ItemGroup Label="Aspire">
     <PackageVersion Include="Aspire.Hosting.Docker" Version="13.4.6" />
     <PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="13.4.6" />
@@ -11,7 +22,7 @@
 
   <ItemGroup Label="Marten">
     <PackageVersion Include="Marten" Version="9.14.1" />
-    <PackageVersion Include="Marten.AspNetCore" Version="9.0.2" />
+    <PackageVersion Include="Marten.AspNetCore" Version="9.14.1" />
   </ItemGroup>
 
   <ItemGroup Label="Wolverine">
@@ -48,7 +59,7 @@
 
   <ItemGroup Label="Messaging">
     <PackageVersion Include="MailKit" Version="4.17.0" />
-    <PackageVersion Include="Quartz.Extensions.Hosting" Version="3.18.1" />
+    <PackageVersion Include="Quartz.Extensions.Hosting" Version="3.18.2" />
   </ItemGroup>
 
   <ItemGroup Label="Testing">
diff --git a/src/AndreGoepel.AppFoundation.Hosting/packages.lock.json b/src/AndreGoepel.AppFoundation.Hosting/packages.lock.json
index 436435f..3d952fe 100644
--- a/src/AndreGoepel.AppFoundation.Hosting/packages.lock.json
+++ b/src/AndreGoepel.AppFoundation.Hosting/packages.lock.json
@@ -604,7 +604,7 @@
       },
       "Marten.AspNetCore": {
         "type": "CentralTransitive",
-        "requested": "[9.0.2, )",
+        "requested": "[9.14.1, )",
         "resolved": "9.14.1",
         "contentHash": "smf1RZMDMlTrl+WYkKHbrZbXI9WJPMPa0ZsFkJ5owmzrOn3kueD4h7cnwZlvCWbaDoybo8XKoZs92yuQ+5OEbg==",
         "dependencies": {
@@ -677,7 +677,7 @@
       },
       "Quartz.Extensions.Hosting": {
         "type": "CentralTransitive",
-        "requested": "[3.18.1, )",
+        "requested": "[3.18.2, )",
         "resolved": "3.18.2",
         "contentHash": "6uSMAm4FArjtVoxBjlkA+gHL1Eln2ngIOnRTrVrYxtSlM5PpLQd2aV+fc/OOwfwt+AyDm69HOAybEFqVvyyG2A==",
         "dependencies": {
diff --git a/src/AndreGoepel.AppFoundation/packages.lock.json b/src/AndreGoepel.AppFoundation/packages.lock.json
index 1f1e091..adf43a0 100644
--- a/src/AndreGoepel.AppFoundation/packages.lock.json
+++ b/src/AndreGoepel.AppFoundation/packages.lock.json
@@ -287,7 +287,7 @@
       },
       "Marten.AspNetCore": {
         "type": "CentralTransitive",
-        "requested": "[9.0.2, )",
+        "requested": "[9.14.1, )",
         "resolved": "9.14.1",
         "contentHash": "smf1RZMDMlTrl+WYkKHbrZbXI9WJPMPa0ZsFkJ5owmzrOn3kueD4h7cnwZlvCWbaDoybo8XKoZs92yuQ+5OEbg==",
         "dependencies": {
@@ -296,7 +296,7 @@
       },
       "Quartz.Extensions.Hosting": {
         "type": "CentralTransitive",
-        "requested": "[3.18.1, )",
+        "requested": "[3.18.2, )",
         "resolved": "3.18.2",
         "contentHash": "6uSMAm4FArjtVoxBjlkA+gHL1Eln2ngIOnRTrVrYxtSlM5PpLQd2aV+fc/OOwfwt+AyDm69HOAybEFqVvyyG2A==",
         "dependencies": {
diff --git a/tests/AndreGoepel.AppFoundation.Tests/packages.lock.json b/tests/AndreGoepel.AppFoundation.Tests/packages.lock.json
index fe55e19..64d8d23 100644
--- a/tests/AndreGoepel.AppFoundation.Tests/packages.lock.json
+++ b/tests/AndreGoepel.AppFoundation.Tests/packages.lock.json
@@ -83,11 +83,6 @@
         "resolved": "1.3.1",
         "contentHash": "aHaTONAIw9m1aaDaq+maJD93A4fni+XbrucJ2YoZwou//sZL6Zo0xSpsuKr8tztpKd7xrRWfYPu/azfEylXwrA=="
       },
-      "AngleSharp": {
-        "type": "Transitive",
-        "resolved": "1.4.0",
-        "contentHash": "6ph8mpaQx0KL0COYRt0kI8MB9gSp1PtKijKMhJU//+aVFgKAJLKDesG/+26JSaVCOrHNgPf12wpfoyRcMYOeXg=="
-      },
       "AngleSharp.Css": {
         "type": "Transitive",
         "resolved": "1.0.0-beta.157",
@@ -791,6 +786,12 @@
           "Radzen.Blazor": "11.1.3"
         }
       },
+      "AngleSharp": {
+        "type": "CentralTransitive",
+        "requested": "[1.5.2, )",
+        "resolved": "1.5.2",
+        "contentHash": "LVZ7rrr6GHbhERhTgVDarVygl1e6KwE96pronA90LBOMacDhxR4lB+xYLjn/vlnUu+xbOB2RM9fuCPEx5bdyWA=="
+      },
       "MailKit": {
         "type": "CentralTransitive",
         "requested": "[4.17.0, )",
@@ -815,7 +816,7 @@
       },
       "Marten.AspNetCore": {
         "type": "CentralTransitive",
-        "requested": "[9.0.2, )",
+        "requested": "[9.14.1, )",
         "resolved": "9.14.1",
         "contentHash": "smf1RZMDMlTrl+WYkKHbrZbXI9WJPMPa0ZsFkJ5owmzrOn3kueD4h7cnwZlvCWbaDoybo8XKoZs92yuQ+5OEbg==",
         "dependencies": {
@@ -894,7 +895,7 @@
       },
       "Quartz.Extensions.Hosting": {
         "type": "CentralTransitive",
-        "requested": "[3.18.1, )",
+        "requested": "[3.18.2, )",
         "resolved": "3.18.2",
         "contentHash": "6uSMAm4FArjtVoxBjlkA+gHL1Eln2ngIOnRTrVrYxtSlM5PpLQd2aV+fc/OOwfwt+AyDm69HOAybEFqVvyyG2A==",
         "dependencies": {