diff --git a/src/FinApp.App.Web/FinApp.App.Web.csproj b/src/FinApp.App.Web/FinApp.App.Web.csproj
index 5806237b..dc4f90db 100644
--- a/src/FinApp.App.Web/FinApp.App.Web.csproj
+++ b/src/FinApp.App.Web/FinApp.App.Web.csproj
@@ -15,8 +15,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="9.0.6" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="9.0.6" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="9.0.19" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.11" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/FinApp.Persistence/FinApp.Persistence.csproj b/src/FinApp.Persistence/FinApp.Persistence.csproj
index 6a623376..b3c46df3 100644
--- a/src/FinApp.Persistence/FinApp.Persistence.csproj
+++ b/src/FinApp.Persistence/FinApp.Persistence.csproj
@@ -5,8 +5,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite.Core" Version="9.0.6" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.6">
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite.Core" Version="9.0.19" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.19">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
diff --git a/src/FinApp.Server/FinApp.Server.csproj b/src/FinApp.Server/FinApp.Server.csproj
index 39518222..1104602e 100644
--- a/src/FinApp.Server/FinApp.Server.csproj
+++ b/src/FinApp.Server/FinApp.Server.csproj
@@ -19,13 +19,13 @@
     <!-- The assistant (R3). Server-side only, deliberately: the client's CSP keeps connect-src 'self', so the
          browser never talks to a model provider — and the key never leaves this process. -->
     <PackageReference Include="Anthropic" Version="12.44.0" />
-    <PackageReference Include="ClosedXML" Version="0.105.0" />
+    <PackageReference Include="ClosedXML" Version="0.105.1" />
     <!-- Envelope-encrypt the account snapshot at rest: a per-write data key wrapped by a Cloud KMS key. -->
-    <PackageReference Include="Google.Cloud.Kms.V1" Version="3.14.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.6" />
+    <PackageReference Include="Google.Cloud.Kms.V1" Version="3.26.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.19" />
     <!-- QR image for 2FA enrollment (PngByteQRCode is System.Drawing-free, so it works on Linux/Cloud Run). -->
-    <PackageReference Include="QRCoder" Version="1.6.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="9.0.6" />
+    <PackageReference Include="QRCoder" Version="1.8.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="9.0.19" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />
   </ItemGroup>
 
diff --git a/src/FinApp.Shared.UI/FinApp.Shared.UI.csproj b/src/FinApp.Shared.UI/FinApp.Shared.UI.csproj
index 51915b3d..cb4958a0 100644
--- a/src/FinApp.Shared.UI/FinApp.Shared.UI.csproj
+++ b/src/FinApp.Shared.UI/FinApp.Shared.UI.csproj
@@ -12,8 +12,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Components.Web" Version="9.0.17" />
-    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="9.0.6" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.Web" Version="9.0.19" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.11" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/FinApp.Domain.Tests/FinApp.Domain.Tests.csproj b/tests/FinApp.Domain.Tests/FinApp.Domain.Tests.csproj
index 98aa716f..d74c1402 100644
--- a/tests/FinApp.Domain.Tests/FinApp.Domain.Tests.csproj
+++ b/tests/FinApp.Domain.Tests/FinApp.Domain.Tests.csproj
@@ -8,10 +8,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="coverlet.collector" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/FinApp.Persistence.Tests/FinApp.Persistence.Tests.csproj b/tests/FinApp.Persistence.Tests/FinApp.Persistence.Tests.csproj
index 8991817a..bd311d2c 100644
--- a/tests/FinApp.Persistence.Tests/FinApp.Persistence.Tests.csproj
+++ b/tests/FinApp.Persistence.Tests/FinApp.Persistence.Tests.csproj
@@ -8,10 +8,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="coverlet.collector" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/FinApp.Server.Tests/FinApp.Server.Tests.csproj b/tests/FinApp.Server.Tests/FinApp.Server.Tests.csproj
index ff852366..a645fa6e 100644
--- a/tests/FinApp.Server.Tests/FinApp.Server.Tests.csproj
+++ b/tests/FinApp.Server.Tests/FinApp.Server.Tests.csproj
@@ -8,12 +8,12 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.6" />
-    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="9.0.6" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="coverlet.collector" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.19" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.11" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.0" />
   </ItemGroup>
 
   <ItemGroup>