diff --git a/backend/Directory.Packages.props b/backend/Directory.Packages.props
index fb1c4061..8fafd05a 100644
--- a/backend/Directory.Packages.props
+++ b/backend/Directory.Packages.props
@@ -13,7 +13,7 @@
   <ItemGroup>
     <!-- API -->
     <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.9.0" />
-    <PackageVersion Include="OpenTelemetry.Api" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Api" Version="1.18.0" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.2.3" />
     <!-- Console / Hosting -->
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.7" />
@@ -24,14 +24,14 @@
          10.0.7 transitively, which clears GHSA-9mv3-2cwr-p262 / CVE-2026-40372
          (affected <= 10.0.6). The runtime-shared DataProtection is intentionally
          not referenced directly (NU1510: redundant with the shared framework). -->
-    <PackageVersion Include="Aspire.Npgsql" Version="13.4.6" />
+    <PackageVersion Include="Aspire.Npgsql" Version="13.5.3" />
     <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.11" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.11" />
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <!-- Persistence — Marten + Wolverine (event-sourcing + outbox) -->
-    <PackageVersion Include="Marten" Version="9.25.0" />
-    <PackageVersion Include="Marten.EntityFrameworkCore" Version="9.25.0" />
+    <PackageVersion Include="Marten" Version="9.31.2" />
+    <PackageVersion Include="Marten.EntityFrameworkCore" Version="9.31.2" />
     <!-- WolverineFx pinned at 6.17.0 (NOT the Dependabot-proposed 6.19.0 / this
          group's 6.18.0): both 6.18.0 and 6.19.0 regress Wolverine's Marten
          transactional middleware for a synchronously-dispatched command
@@ -55,13 +55,13 @@
     <PackageVersion Include="WolverineFx.Marten" Version="6.17.0" />
     <PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.17.0" />
     <!-- Observability — OpenTelemetry -->
-    <PackageVersion Include="OpenTelemetry" Version="1.17.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
     <!-- LLM / Prompt -->
-    <PackageVersion Include="Anthropic" Version="12.40.0" />
+    <PackageVersion Include="Anthropic" Version="12.45.0" />
     <PackageVersion Include="YamlDotNet" Version="18.1.0" />
     <!-- Configuration (eval tests) -->
     <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.11" />
@@ -107,6 +107,6 @@
     <PackageVersion Include="xunit.v3.core.mtp-v2" Version="3.2.2" />
     <!-- Analyzers -->
     <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.32.0.713" />
+    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.33.0.1635" />
   </ItemGroup>
 </Project>
\ No newline at end of file