diff --git a/Directory.Packages.props b/Directory.Packages.props
index 684e6b9cb..614a25e55 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -17,14 +17,14 @@
          Serilog.AspNetCore is what puts the host's own logging on the family's sinks. Both are the
          versions dew_flow_creds_for_devs runs, because the server mirrors its authentication and a
          pair that disagreed would be a difference nobody chose. -->
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
     <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
     <!-- Drives the server in-process for its tests: no port, no container, no network. -->
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
     <!-- Must not trail what JwtBearer 10.0.11 pulls in transitively: the test project mints its
          own tokens with this, and two versions of the same handler in one process is the kind of
          mismatch that only shows up as a signature nobody can validate. -->
-    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.22.0" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.23.0" />
 
     <!-- The one logging stack, per .claude/rules/shared/common/logging-serilog.md.
          The console sink is our own AnsiConsoleSink (the packaged themes emit nothing
@@ -38,7 +38,7 @@
          one pins SQLitePCLRaw 2.1.11, whose native lib.e_sqlite3 carries GHSA-2m69-gcr7-jv3q (high),
          and this repository builds warnings-as-errors on advisories. The 3.x family is the fixed
          one. Apache-2.0 / MIT. -->
-    <PackageVersion Include="Microsoft.Data.Sqlite.Core" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Data.Sqlite.Core" Version="10.0.12" />
     <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
 
     <PackageVersion Include="Serilog" Version="4.4.0" />
@@ -72,7 +72,7 @@
     <!-- xUnit v3 on the native Microsoft Testing Platform: the test project builds into a
          self-contained runner executable. There is no VSTest testhost here, so `dotnet test`
          aborts — run the executable (.claude/rules/shared/common/testing.md). -->
-    <PackageVersion Include="xunit.v3" Version="4.0.0" />
+    <PackageVersion Include="xunit.v3" Version="4.0.1" />
 
     <!-- 7.2.2 = the last Apache-2.0 release; 8.x moved to the Xceed Community License
          (non-commercial only). Do NOT bump. -->
diff --git a/src_server/src/CoaiServer.csproj b/src_server/src/CoaiServer.csproj
index 51a268229..d8552b3fc 100644
--- a/src_server/src/CoaiServer.csproj
+++ b/src_server/src/CoaiServer.csproj
@@ -21,6 +21,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
     <PackageReference Include="Serilog.AspNetCore" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" VersionOverride="8.23.0" />
   </ItemGroup>
 
   <ItemGroup>