diff --git a/Directory.Packages.props b/Directory.Packages.props
index d1ad6eeb..71e1ff93 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -145,6 +145,27 @@
     <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
   </ItemGroup>
 
+  <!--
+    Four NU1903 high-severity advisories (GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h,
+    GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f) landed in the NuGet audit data against
+    System.Security.Cryptography.Xml 10.0.7, pulled in TRANSITIVELY by
+    Microsoft.AspNetCore.DataProtection 10.0.7 (ConfigurationDatabase's DataProtection
+    key storage). With TreatWarningsAsErrors any FRESH restore — notably the docker
+    image build — went red (surfaced 2026-07-21; local builds had cached audit data).
+
+    Same pattern as SQLitePCLRaw above: pin the vulnerable transitive package to its
+    patched version (10.0.10) with an explicit <PackageReference> in the one project
+    where the chain enters (ConfigurationDatabase; every other resolver — AuditLog,
+    SiteCallAudit, Transport, PerformanceTests, tests — reaches it through that
+    ProjectReference). Bumping the DataProtection parent instead was tried and
+    rejected: 10.0.10 floors Microsoft.Extensions.* and (via the EFCore adapter)
+    Microsoft.EntityFrameworkCore at 10.0.10, forcing a family-wide servicing bump
+    (NU1605 downgrade errors) that belongs in its own reviewed commit.
+  -->
+  <ItemGroup>
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+  </ItemGroup>
+
   <!--
     GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp, reached only transitively via bunit
     in ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors it made the WHOLE
diff --git a/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj b/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
index d6d5a4ca..5af71404 100644
--- a/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj
@@ -20,6 +20,10 @@
     <PackageReference Include="Microsoft.Extensions.Options" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" />
+    <!-- Direct pin of a transitive dependency of Microsoft.AspNetCore.DataProtection:
+         10.0.7 carries four NU1903 high-severity advisories that break fresh restores
+         under TreatWarningsAsErrors. See Directory.Packages.props for the rationale. -->
+    <PackageReference Include="System.Security.Cryptography.Xml" />
   </ItemGroup>
 
   <ItemGroup>