diff --git a/src/Directory.Build.props b/src/Directory.Build.props
index a9a856a..dedc388 100644
--- a/src/Directory.Build.props
+++ b/src/Directory.Build.props
@@ -34,10 +34,16 @@
     </PropertyGroup>
   </Target>
 
-  <!-- SQLitePCLRaw.lib.e_sqlite3 2.1.11 (transitive via Microsoft.Data.Sqlite) carries GHSA-2m69-gcr7-jv3q,
-       which surfaces as NU1903 (warning-as-error). No patched e_sqlite3 release exists yet (2.1.11 is latest),
-       so this targeted suppression keeps every OTHER transitive package audited. Remove once an upstream fix ships. -->
-  <ItemGroup>
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
-  </ItemGroup>
+  <!-- GHSA-2m69-gcr7-jv3q (NU1903, high) on the native SQLitePCLRaw.lib.e_sqlite3, pulled in
+       transitively by Microsoft.Data.Sqlite.
+
+       The suppression that used to live here said "No patched e_sqlite3 release exists yet
+       (2.1.11 is latest) ... Remove once an upstream fix ships." That fix HAS shipped: 2.1.12
+       patches this advisory within the 2.1.x line. Suppression removed 2026-07-18, so the
+       advisory is audited again instead of silenced.
+
+       The Server project already resolved 2.1.12, but only incidentally — transitively via
+       ZB.MOM.WW.Auth.ApiKeys. The pin in that project makes the floor intentional, so a change
+       to the Auth dependency graph cannot silently drop it back to the vulnerable 2.1.11.
+       Verified: forced restore with no suppression reports no NU1903. -->
 </Project>
diff --git a/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj b/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj
index bbb0005..b5c5bc6 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj
+++ b/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj
@@ -25,6 +25,9 @@
     <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
     <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.0" />
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.7" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the vulnerable
+         native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not clear it. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
     <PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.2" />
     <PackageReference Include="Polly.Core" Version="8.6.6" />
   </ItemGroup>