diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 679962cd..4f36787e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -36,6 +36,15 @@ updates:
       - "ClaudiodelaRiva"
     rebase-strategy: "disabled"
     open-pull-requests-limit: 30
+    groups:
+      # AspNetCore/DependencyCollector/Kubernetes cross-depend on the core
+      # Microsoft.ApplicationInsights package version range, so bumping one
+      # without the others can produce an unresolvable NuGet graph (e.g.
+      # Kubernetes 8.0.1 requires core [2.23.0, 3.0.0), but AspNetCore 3.1.2
+      # requires core >=3.1.2). Update them together in a single PR.
+      application-insights:
+        patterns:
+          - "Microsoft.ApplicationInsights*"
     ignore:
       # Block ALL .NET major-version bumps (runtime, ASP.NET Core, EF Core, etc.)
       - dependency-name: "Microsoft.AspNetCore.*"
diff --git a/sut/src/Directory.Packages.props b/sut/src/Directory.Packages.props
index 4111dc0c..13451f42 100644
--- a/sut/src/Directory.Packages.props
+++ b/sut/src/Directory.Packages.props
@@ -18,6 +18,7 @@
     <PackageVersion Include="Azure.Messaging.ServiceBus" Version="7.20.1" />
     <PackageVersion Include="BuildBundlerMinifier" Version="3.2.449" />
     <PackageVersion Include="Dapper" Version="2.1.79" />
+    <PackageVersion Include="Duende.IdentityModel" Version="8.1.0" />
     <PackageVersion Include="Duende.IdentityServer" Version="8.0.2" />
     <PackageVersion Include="Duende.IdentityServer.AspNetIdentity" Version="8.0.2" />
     <PackageVersion Include="Duende.IdentityServer.EntityFramework" Version="8.0.2" />
@@ -33,9 +34,9 @@
     <PackageVersion Include="Grpc.Net.ClientFactory" Version="2.51.0" />
     <PackageVersion Include="Grpc.Tools" Version="2.81.1" PrivateAssets="All" />
     <PackageVersion Include="MediatR" Version="14.1.0" />
-    <PackageVersion Include="Microsoft.ApplicationInsights.AspNetCore" Version="3.1.2" />
+    <PackageVersion Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.23.0" />
     <PackageVersion Include="Microsoft.ApplicationInsights.DependencyCollector" Version="2.23.0" />
-    <PackageVersion Include="Microsoft.ApplicationInsights.Kubernetes" Version="6.0.0" />
+    <PackageVersion Include="Microsoft.ApplicationInsights.Kubernetes" Version="8.0.1" />
     <PackageVersion Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.9" />
diff --git a/sut/src/Services/Identity/Identity.API/GlobalUsings.cs b/sut/src/Services/Identity/Identity.API/GlobalUsings.cs
index 439583c5..574c9474 100644
--- a/sut/src/Services/Identity/Identity.API/GlobalUsings.cs
+++ b/sut/src/Services/Identity/Identity.API/GlobalUsings.cs
@@ -6,6 +6,7 @@
 global using System.Security.Claims;
 global using System.Text.RegularExpressions;
 global using System.Threading.Tasks;
+global using Duende.IdentityModel;
 global using Duende.IdentityServer;
 global using Duende.IdentityServer.Configuration;
 global using Duende.IdentityServer.Events;
@@ -14,7 +15,6 @@
 global using Duende.IdentityServer.Services;
 global using Duende.IdentityServer.Stores;
 global using Duende.IdentityServer.Validation;
-global using IdentityModel;
 global using Microsoft.AspNetCore.Authentication;
 global using Microsoft.AspNetCore.Authorization;
 global using Microsoft.AspNetCore.Builder;
diff --git a/sut/src/Services/Identity/Identity.API/Identity.API.csproj b/sut/src/Services/Identity/Identity.API/Identity.API.csproj
index bbd67a14..ad3989c0 100644
--- a/sut/src/Services/Identity/Identity.API/Identity.API.csproj
+++ b/sut/src/Services/Identity/Identity.API/Identity.API.csproj
@@ -8,6 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Duende.IdentityModel" />
     <PackageReference Include="Duende.IdentityServer.AspNetIdentity" />
     <PackageReference Include="Duende.IdentityServer.EntityFramework.Storage" />
     <PackageReference Include="Duende.IdentityServer.EntityFramework" />
diff --git a/sut/src/Services/Identity/Identity.API/Quickstart/Diagnostics/DiagnosticsViewModel.cs b/sut/src/Services/Identity/Identity.API/Quickstart/Diagnostics/DiagnosticsViewModel.cs
index 6f87fd1d..0f965777 100644
--- a/sut/src/Services/Identity/Identity.API/Quickstart/Diagnostics/DiagnosticsViewModel.cs
+++ b/sut/src/Services/Identity/Identity.API/Quickstart/Diagnostics/DiagnosticsViewModel.cs
@@ -2,6 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 
 
+using System.Buffers.Text;
 using System.Text;
 using System.Text.Json;
 
@@ -16,7 +17,7 @@ public DiagnosticsViewModel(AuthenticateResult result)
         if (result.Properties.Items.ContainsKey("client_list"))
         {
             var encoded = result.Properties.Items["client_list"];
-            var bytes = Base64Url.Decode(encoded);
+            var bytes = Base64Url.DecodeFromChars(encoded);
             var value = Encoding.UTF8.GetString(bytes);
 
             Clients = JsonSerializer.Deserialize<string[]>(value);