diff --git a/Directory.Packages.props b/Directory.Packages.props
index 73a777f8..cdc5652a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -69,17 +69,20 @@
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageVersion Include="Microsoft.Playwright" Version="1.58.0" />
     <PackageVersion Include="Moq" Version="4.20.72" />
-    <!-- 13.0.4 is the floor OPCFoundation.NetStandard.Opc.Ua.Core 1.5.378.106 demands; surfaced when
+    <!-- 13.0.4 is the floor OPCFoundation.NetStandard.Opc.Ua.Core 1.5.378.x demands; surfaced when
          CentralPackageTransitivePinningEnabled was turned on (Gitea #79). Also used by the
          Commons.Tests contract-lock tests;
          used by Commons.Tests contract-lock tests that exercise the Akka default JSON serializer. -->
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
     <PackageVersion Include="NSubstitute" Version="5.3.0" />
-    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106" />
+    <!-- 1.5.378.182 = the last SDK 1.5 build OtOpcUa ran before its 2.0.1 move (ScadaBridge#125). The 2.0.x
+         move waits for lmxopcua#799 and #801. Since .156, issuer CA certs need the keyCertSign KeyUsage, and
+         this also applies to server certs the DCL trusts. -->
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.182" />
     <!-- Test-only: in-process secured server for the Gitea #121 Sign/SignAndEncrypt tests.
          Kept in lockstep with the client pin above. -->
-    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="1.5.378.106" />
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="1.5.378.182" />
     <PackageVersion Include="OpenTelemetry.Api" Version="1.15.3" />
     <!-- Parquet audit archival + the parquet format of `audit export` (ScadaBridge#42). 6.1.0 is fully
          managed (Snappier / ZstdSharp / K4os LZ4, no native IronCompress) and NuGetAudit-clean. -->