diff --git a/Directory.Packages.props b/Directory.Packages.props
index 3bb856c5..29e9002d 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -13,8 +13,8 @@
 
   <ItemGroup>
     <!-- Roslyn surface for the Money/Engine analysers (and their test harnesses). -->
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
 
     <!-- PostgreSQL data access (EventStore, RateSheets, migrations). -->
     <PackageVersion Include="Npgsql" Version="10.0.3" />
@@ -24,12 +24,12 @@
          builds GenericRecords + serializes the value bytes. These stay OUT of
          Babelstone.EventStore (Npgsql-only) — they live in Babelstone.Engine.Avro and
          Babelstone.OutboxPublisher (event-store-skeleton §5.4 / §2.1). -->
-    <PackageVersion Include="Confluent.Kafka" Version="2.15.0" />
-    <PackageVersion Include="Confluent.SchemaRegistry" Version="2.15.0" />
+    <PackageVersion Include="Confluent.Kafka" Version="2.15.1" />
+    <PackageVersion Include="Confluent.SchemaRegistry" Version="2.15.1" />
     <PackageVersion Include="Confluent.SchemaRegistry.Serdes.Avro" Version="2.15.0" />
-    <PackageVersion Include="Apache.Avro" Version="1.12.1" />
+    <PackageVersion Include="Apache.Avro" Version="1.12.2" />
     <!-- IHostedService/BackgroundService host for the relay's poll loop. -->
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.12" />
     <!-- IHttpClientFactory for the saga command dispatcher (bd babelstone-t7o3.3, ADR-PC-029): the
          dispatcher drains saga_outbox and delivers each command to the engine over idempotent HTTP.
          The factory owns connection pooling/lifetime; the orchestrator stays extraction-ready
@@ -38,12 +38,12 @@
     <!-- ILogger / EventId for the shared structured-log event-id contract (ADR-IC-007 Layer 1):
          the abstractions only — Babelstone.Telemetry stays backend-/hosting-free, the hosts bring
          the logging implementation. The same 10.0.8 line as the other Microsoft.Extensions pins. -->
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.12" />
 
     <!-- IConfiguration for the application-credential secret boundary (ADR-PC-004 Amendment A1):
          Abstractions for Babelstone.Pii's ConfigurationSecretProvider; the full package for the
          in-memory provider its unit tests build. -->
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
     <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.10" />
 
     <!-- Test toolchain: runner, assertions, property-based testing, integration containers. -->
@@ -87,7 +87,7 @@
          engine spine. The SDK (Extensions.Hosting for AddOpenTelemetry/ConfigureResource and
          the OTLP exporter) is wired only in the two HTTP hosts; the core OpenTelemetry package
          backs the in-memory span fitness test. One pinned 1.x line across all four. -->
-    <PackageVersion Include="OpenTelemetry.Api" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Api" Version="1.19.1" />
     <PackageVersion Include="OpenTelemetry" Version="1.17.0" />
     <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
     <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
diff --git a/engine/.config/dotnet-tools.json b/engine/.config/dotnet-tools.json
index 269a73c9..58fe3878 100644
--- a/engine/.config/dotnet-tools.json
+++ b/engine/.config/dotnet-tools.json
@@ -3,14 +3,14 @@
   "isRoot": true,
   "tools": {
     "dotnet-stryker": {
-      "version": "4.16.0",
+      "version": "5.0.0",
       "commands": [
         "dotnet-stryker"
       ],
       "rollForward": false
     },
     "dotnet-coverage": {
-      "version": "18.9.0",
+      "version": "18.11.2",
       "commands": [
         "dotnet-coverage"
       ],
diff --git a/engine/src/Babelstone.EventStore/Babelstone.EventStore.csproj b/engine/src/Babelstone.EventStore/Babelstone.EventStore.csproj
index ebdb2fc2..7be67af9 100644
--- a/engine/src/Babelstone.EventStore/Babelstone.EventStore.csproj
+++ b/engine/src/Babelstone.EventStore/Babelstone.EventStore.csproj
@@ -10,6 +10,7 @@
          self-describing JSON payload (ADR-PC-028) and does not know it is encrypted.
          A future Go re-implementation of this assembly is what ADR-PC-001 §S3's
          "lowest exit cost" cashes out as. -->
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Npgsql" />
   </ItemGroup>
 
diff --git a/engine/src/Babelstone.OutboxPublisher/Babelstone.OutboxPublisher.csproj b/engine/src/Babelstone.OutboxPublisher/Babelstone.OutboxPublisher.csproj
index d5d1f244..193e34dd 100644
--- a/engine/src/Babelstone.OutboxPublisher/Babelstone.OutboxPublisher.csproj
+++ b/engine/src/Babelstone.OutboxPublisher/Babelstone.OutboxPublisher.csproj
@@ -9,6 +9,7 @@
          touches both PostgreSQL (the outbox, via Npgsql) and Redpanda (Confluent.Kafka).
          The engine's write half does not know Redpanda exists. Confluent deps stay HERE
          (and in Babelstone.Engine.Avro) — never in Babelstone.EventStore. -->
+    <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" />
     <PackageReference Include="Npgsql" />
     <PackageReference Include="Confluent.Kafka" />
     <PackageReference Include="Confluent.SchemaRegistry" />