diff --git a/ZB.MOM.WW.Auth/Directory.Packages.props b/ZB.MOM.WW.Auth/Directory.Packages.props
index 3b06c64..63d7500 100644
--- a/ZB.MOM.WW.Auth/Directory.Packages.props
+++ b/ZB.MOM.WW.Auth/Directory.Packages.props
@@ -23,6 +23,11 @@
          9.0.4, which requires ProtectedData >= 9.0.4. With transitive pinning on, the lower central
          version is a hard NU1109 downgrade error rather than a silent resolve. -->
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
+    <!-- Transitive security pin (scadaproj#22): Microsoft.Data.SqlClient 6.0.2 pulls
+         System.Security.Cryptography.Pkcs 9.0.4, which carries GHSA-846f-f764-76mx (high) and
+         GHSA-2fmv-rv2c-59x7 (moderate) and fails restore under warnings-as-errors (NU1902/NU1903).
+         Pin the patched 9.0.21 (first fixed in the 9.0 line; 9.0.0-9.0.20 and 10.0.0-10.0.12 are all affected). -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
 
     <!-- Extensions -->
     <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
diff --git a/ZB.MOM.WW.Secrets/Directory.Packages.props b/ZB.MOM.WW.Secrets/Directory.Packages.props
index f8c5814..1ecde1e 100644
--- a/ZB.MOM.WW.Secrets/Directory.Packages.props
+++ b/ZB.MOM.WW.Secrets/Directory.Packages.props
@@ -46,6 +46,11 @@
          9.0.4, which requires ProtectedData >= 9.0.4. With transitive pinning on, the lower central
          version is a hard NU1109 downgrade error rather than a silent resolve. -->
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
+    <!-- Transitive security pin (scadaproj#22): Microsoft.Data.SqlClient 6.0.2 pulls
+         System.Security.Cryptography.Pkcs 9.0.4, which carries GHSA-846f-f764-76mx (high) and
+         GHSA-2fmv-rv2c-59x7 (moderate) and fails restore under warnings-as-errors (NU1902/NU1903).
+         Pin the patched 9.0.21 (first fixed in the 9.0 line; 9.0.0-9.0.20 and 10.0.0-10.0.12 are all affected). -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.21" />
 
     <!-- Extensions -->
     <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />