diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index 0d6d304..5c1165b 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "dotnet-ef": {
-      "version": "10.0.0",
+      "version": "10.0.12",
       "commands": [
         "dotnet-ef"
       ],
diff --git a/src/MX.TripSideKick.Application/MX.TripSideKick.Application.csproj b/src/MX.TripSideKick.Application/MX.TripSideKick.Application.csproj
index b74ea5a..56a5182 100644
--- a/src/MX.TripSideKick.Application/MX.TripSideKick.Application.csproj
+++ b/src/MX.TripSideKick.Application/MX.TripSideKick.Application.csproj
@@ -5,8 +5,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.12" />
     <PackageReference Include="NodaTime" Version="3.3.3" />
   </ItemGroup>
 
diff --git a/src/MX.TripSideKick.Infrastructure/MX.TripSideKick.Infrastructure.csproj b/src/MX.TripSideKick.Infrastructure/MX.TripSideKick.Infrastructure.csproj
index f6c8d51..8f9ebdb 100644
--- a/src/MX.TripSideKick.Infrastructure/MX.TripSideKick.Infrastructure.csproj
+++ b/src/MX.TripSideKick.Infrastructure/MX.TripSideKick.Infrastructure.csproj
@@ -6,16 +6,16 @@
 
   <ItemGroup>
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
-    <PackageReference Include="Azure.Storage.Blobs" Version="12.29.1" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
+    <PackageReference Include="Azure.Storage.Blobs" Version="12.29.2" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.12" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/MX.TripSideKick.Web.Tests/MX.TripSideKick.Web.Tests.csproj b/src/MX.TripSideKick.Web.Tests/MX.TripSideKick.Web.Tests.csproj
index 82afaaf..1f7c141 100644
--- a/src/MX.TripSideKick.Web.Tests/MX.TripSideKick.Web.Tests.csproj
+++ b/src/MX.TripSideKick.Web.Tests/MX.TripSideKick.Web.Tests.csproj
@@ -7,20 +7,20 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.10.0" />
     <PackageReference Include="Moq" Version="4.20.72" />
     <!-- Transitive System.Security.Cryptography.Xml 10.0.7 is vulnerable; pin to a patched build. -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.12" />
     <!-- Transitive SSH.NET <= 2025.1.0 (via Testcontainers) carries GHSA-q939-rpr3-3284; pin to the patched build. -->
     <PackageReference Include="SSH.NET" Version="2026.0.0" />
-    <PackageReference Include="Testcontainers.MsSql" Version="4.13.0" />
+    <PackageReference Include="Testcontainers.MsSql" Version="4.15.0" />
     <PackageReference Include="coverlet.collector" Version="10.0.1">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/src/MX.TripSideKick.Web/MX.TripSideKick.Web.csproj b/src/MX.TripSideKick.Web/MX.TripSideKick.Web.csproj
index 9086439..14b553c 100644
--- a/src/MX.TripSideKick.Web/MX.TripSideKick.Web.csproj
+++ b/src/MX.TripSideKick.Web/MX.TripSideKick.Web.csproj
@@ -26,10 +26,10 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.5.3" />
+    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.5.4" />
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
     <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.23.0" />
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
     <!--
       dotnet-ef's design-time services must be discoverable from the *startup* project (this one),
       not only the project containing the DbContext (MX.TripSideKick.Infrastructure) - see
@@ -37,14 +37,14 @@
       keeps it out of the published/runtime output; it is only ever used by `dotnet ef` at
       development/CI time (see docs/data-and-persistence.md and tests/e2e/support/migrate.ts).
     -->
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.Identity.Web" Version="4.14.2" />
     <!-- Transitive Microsoft.OpenApi 2.0.0 carries GHSA-v5pm-xwqc-g5wc; pin to a patched build. -->
-    <PackageReference Include="Microsoft.OpenApi" Version="2.11.0" />
-    <PackageReference Include="MX.Observability.ApplicationInsights.AspNetCore" Version="1.1.28" />
+    <PackageReference Include="Microsoft.OpenApi" Version="3.10.2" />
+    <PackageReference Include="MX.Observability.ApplicationInsights.AspNetCore" Version="1.1.31" />
   </ItemGroup>
 
   <ItemGroup>