diff --git a/backend/CoffeeTracker.Api/CoffeeTracker.Api.csproj b/backend/CoffeeTracker.Api/CoffeeTracker.Api.csproj
index 28d960f..d8cc75a 100644
--- a/backend/CoffeeTracker.Api/CoffeeTracker.Api.csproj
+++ b/backend/CoffeeTracker.Api/CoffeeTracker.Api.csproj
@@ -5,7 +5,7 @@
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.7" />
     <!-- Direct pin: Microsoft.AspNetCore.OpenApi still pulls 2.0.0, which is flagged
          by NU1903 (GHSA-v5pm-xwqc-g5wc); drop this once it references >= 2.7.5. -->
-    <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
+    <PackageReference Include="Microsoft.OpenApi" Version="3.8.0" />
     <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
     <PackageReference Include="Swashbuckle.AspNetCore.SwaggerUI" Version="10.2.3" />
   </ItemGroup>
diff --git a/backend/CoffeeTracker.Api/packages.lock.json b/backend/CoffeeTracker.Api/packages.lock.json
index 8df7882..04c19f6 100644
--- a/backend/CoffeeTracker.Api/packages.lock.json
+++ b/backend/CoffeeTracker.Api/packages.lock.json
@@ -22,9 +22,9 @@
       },
       "Microsoft.OpenApi": {
         "type": "Direct",
-        "requested": "[2.7.5, )",
-        "resolved": "2.7.5",
-        "contentHash": "0FA67RSnRM4tcBKqiqVu/HPdZ9+QOKbmeRjxRUGTCjPU4C0bmUhd97Dso7Yild5P7nOV6GxJ2xrK0Kv/O9xp0w=="
+        "requested": "[3.8.0, )",
+        "resolved": "3.8.0",
+        "contentHash": "bF+KnfJSd9KLUOZxl07IdhmQcvz/adqU+GVub7+SVOydHpJGOGIWqwngZ3JxgtDpKYRA6vlk+0tv82G0KXRuhw=="
       },
       "Serilog.AspNetCore": {
         "type": "Direct",