diff --git a/Directory.Packages.props b/Directory.Packages.props
index 1bc93c6..18be693 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,8 +1,19 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <!-- Let a central PackageVersion override a transitive dependency's resolved
+         version without a direct PackageReference (see AngleSharp pin below). -->
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
 
+  <ItemGroup Label="Transitive security pins">
+    <!-- bUnit -> AngleSharp.Diffing pulls AngleSharp 1.4.0, which has a moderate
+         mXSS advisory (GHSA-pgww-w46g-26qg / CVE-2026-54570). Pin to the patched
+         1.5.x line to clear the CI vulnerability gate. Remove once bUnit ships a
+         transitive chain that resolves to >= 1.5.0 on its own (tracked in #107). -->
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
+  </ItemGroup>
+
   <ItemGroup Label="Marten">
     <PackageVersion Include="Marten" Version="9.15.4" />
     <PackageVersion Include="Marten.AspNetCore" Version="9.15.4" />
diff --git a/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json b/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json
index 72735c5..910a7d2 100644
--- a/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json
+++ b/tests/AndreGoepel.Marten.Identity.Blazor.Tests/packages.lock.json
@@ -55,11 +55,6 @@
           "xunit.v3.mtp-v1": "[3.2.2]"
         }
       },
-      "AngleSharp": {
-        "type": "Transitive",
-        "resolved": "1.4.0",
-        "contentHash": "6ph8mpaQx0KL0COYRt0kI8MB9gSp1PtKijKMhJU//+aVFgKAJLKDesG/+26JSaVCOrHNgPf12wpfoyRcMYOeXg=="
-      },
       "AngleSharp.Css": {
         "type": "Transitive",
         "resolved": "1.0.0-beta.157",
@@ -402,6 +397,12 @@
           "Radzen.Blazor": "11.1.3"
         }
       },
+      "AngleSharp": {
+        "type": "CentralTransitive",
+        "requested": "[1.5.2, )",
+        "resolved": "1.5.2",
+        "contentHash": "LVZ7rrr6GHbhERhTgVDarVygl1e6KwE96pronA90LBOMacDhxR4lB+xYLjn/vlnUu+xbOB2RM9fuCPEx5bdyWA=="
+      },
       "Marten": {
         "type": "CentralTransitive",
         "requested": "[9.15.4, )",