diff --git a/backend/Directory.Packages.props b/backend/Directory.Packages.props
index 634fb2cc..cfe9e475 100644
--- a/backend/Directory.Packages.props
+++ b/backend/Directory.Packages.props
@@ -12,47 +12,47 @@
   </PropertyGroup>
   <ItemGroup>
     <!-- API -->
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.7.0" />
-    <PackageVersion Include="OpenTelemetry.Api" Version="1.16.0" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.8.0" />
+    <PackageVersion Include="OpenTelemetry.Api" Version="1.17.0" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.2.3" />
     <!-- Console / Hosting -->
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.7" />
     <!-- Auth — ASP.NET Core authentication -->
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
     <!-- Persistence — EF Core + Identity + DataProtection + Npgsql.
          The DataProtection.EntityFrameworkCore 10.0.7 bump pulls DataProtection
          10.0.7 transitively, which clears GHSA-9mv3-2cwr-p262 / CVE-2026-40372
          (affected <= 10.0.6). The runtime-shared DataProtection is intentionally
          not referenced directly (NU1510: redundant with the shared framework). -->
     <PackageVersion Include="Aspire.Npgsql" Version="13.4.6" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9" />
-    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10" />
+    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <!-- Persistence — Marten + Wolverine (event-sourcing + outbox) -->
-    <PackageVersion Include="Marten" Version="9.14.0" />
-    <PackageVersion Include="Marten.EntityFrameworkCore" Version="9.14.0" />
-    <PackageVersion Include="WolverineFx" Version="6.17.0" />
-    <PackageVersion Include="WolverineFx.EntityFrameworkCore" Version="6.17.0" />
-    <PackageVersion Include="WolverineFx.Marten" Version="6.17.0" />
-    <PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.17.0" />
+    <PackageVersion Include="Marten" Version="9.15.4" />
+    <PackageVersion Include="Marten.EntityFrameworkCore" Version="9.15.4" />
+    <PackageVersion Include="WolverineFx" Version="6.19.0" />
+    <PackageVersion Include="WolverineFx.EntityFrameworkCore" Version="6.19.0" />
+    <PackageVersion Include="WolverineFx.Marten" Version="6.19.0" />
+    <PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.19.0" />
     <!-- Observability — OpenTelemetry -->
-    <PackageVersion Include="OpenTelemetry" Version="1.16.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
+    <PackageVersion Include="OpenTelemetry" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.16.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.16.0" />
     <!-- LLM / Prompt -->
     <PackageVersion Include="Anthropic" Version="12.35.1" />
     <PackageVersion Include="YamlDotNet" Version="18.1.0" />
     <!-- Configuration (eval tests) -->
-    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.10" />
     <!-- AI Evaluation -->
-    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation" Version="10.7.0" />
-    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Quality" Version="10.7.0" />
-    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Reporting" Version="10.7.0" />
+    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation" Version="10.8.0" />
+    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Quality" Version="10.8.0" />
+    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Reporting" Version="10.8.0" />
     <!-- Testing -->
     <PackageVersion Include="coverlet.MTP" Version="10.0.1" />
     <PackageVersion Include="FluentAssertions" Version="8.10.0" />
@@ -82,6 +82,6 @@
     <PackageVersion Include="xunit.v3.core.mtp-v2" Version="3.2.2" />
     <!-- Analyzers -->
     <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.28.0.143324" />
+    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.29.0.143774" />
   </ItemGroup>
 </Project>
\ No newline at end of file