diff --git a/Directory.Packages.props b/Directory.Packages.props
index 779c047..98ee933 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -14,41 +14,41 @@
     <!-- Client-side RabbitMQ integration: registers a readiness health check for the broker (the outbox
          relay's transport), which Wolverine's own UseRabbitMq connection does not surface. -->
     <PackageVersion Include="Aspire.RabbitMQ.Client" Version="13.4.6" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
     <!-- ServiceDefaults: telemetry, resilience, service discovery -->
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.7.0" />
-    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.7.0" />
-    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery.Yarp" Version="10.7.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.16.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.16.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.15.1" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
+    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.8.0" />
+    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery.Yarp" Version="10.8.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.17.0" />
     <!-- Data access -->
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9" />
     <!-- Pinned to unify the version Aspire's Npgsql integration pulls transitively (avoids MSB3277). -->
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.9" />
-    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <!-- Messaging: Wolverine for the transactional outbox + RabbitMQ transport (chosen after the
          2025 licensing shift; MassTransit v8 is the last OSS line, kept as a fallback). -->
-    <PackageVersion Include="WolverineFx" Version="6.16.0" />
-    <PackageVersion Include="WolverineFx.EntityFrameworkCore" Version="6.16.0" />
-    <PackageVersion Include="WolverineFx.Postgresql" Version="6.16.0" />
-    <PackageVersion Include="WolverineFx.RabbitMQ" Version="6.16.0" />
+    <PackageVersion Include="WolverineFx" Version="6.21.0" />
+    <PackageVersion Include="WolverineFx.EntityFrameworkCore" Version="6.21.0" />
+    <PackageVersion Include="WolverineFx.Postgresql" Version="6.21.0" />
+    <PackageVersion Include="WolverineFx.RabbitMQ" Version="6.21.0" />
     <!-- Wolverine 6 split the Roslyn runtime compiler out of core; without it Wolverine's default
          TypeLoadMode.Dynamic has no IAssemblyGenerator and fails at startup (GH-2876). -->
-    <PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.16.0" />
+    <PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.21.0" />
     <PackageVersion Include="MassTransit" Version="8.5.10" />
     <PackageVersion Include="MassTransit.EntityFrameworkCore" Version="8.5.10" />
     <PackageVersion Include="MassTransit.RabbitMQ" Version="8.5.10" />
     <!-- API -->
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />
     <!-- BI export (docs/BI_Plan.md §11): writes Bronze-ready Parquet to the S3 landing zone that
          Databricks Auto Loader later reads. Only loaded where BiExport:BucketName is configured. -->
-    <PackageVersion Include="AWSSDK.S3" Version="4.0.100.1" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.101.3" />
     <PackageVersion Include="Parquet.Net" Version="6.0.3" />
     <!-- CDC-to-Bronze (docs/BI_Plan.md — CDC section): Warehouse.CdcBridge consumes Debezium's raw
          CDC JSON off RabbitMQ directly with the AMQP client (not Wolverine — these aren't typed
@@ -56,18 +56,18 @@
     <PackageVersion Include="RabbitMQ.Client" Version="7.2.1" />
     <!-- Tests -->
     <PackageVersion Include="coverlet.collector" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageVersion Include="NetArchTest.Rules" Version="1.3.2" />
-    <PackageVersion Include="NSubstitute" Version="5.3.0" />
+    <PackageVersion Include="NSubstitute" Version="6.0.0" />
     <PackageVersion Include="Respawn" Version="7.0.0" />
-    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.12.0" />
+    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
     <!-- S3-compatible container for BiExport integration tests (docs/BI_Plan.md §11) — same release
          train as Testcontainers.PostgreSql above, kept in lockstep to avoid a mixed-version Testcontainers core. -->
-    <PackageVersion Include="Testcontainers.LocalStack" Version="4.12.0" />
+    <PackageVersion Include="Testcontainers.LocalStack" Version="4.13.0" />
     <!-- CdcBridge integration test: a real RabbitMQ container to prove the AMQP consumer wiring
          (exchange/queue declare, bind, consume, ack) actually works, not just compiles. -->
-    <PackageVersion Include="Testcontainers.RabbitMq" Version="4.12.0" />
+    <PackageVersion Include="Testcontainers.RabbitMq" Version="4.13.0" />
     <PackageVersion Include="xunit.v3" Version="3.2.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>