diff --git a/ZB.MOM.WW.Secrets/Directory.Packages.props b/ZB.MOM.WW.Secrets/Directory.Packages.props
index 1ecde1e..8b9bdd1 100644
--- a/ZB.MOM.WW.Secrets/Directory.Packages.props
+++ b/ZB.MOM.WW.Secrets/Directory.Packages.props
@@ -90,6 +90,10 @@
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
     <PackageVersion Include="coverlet.collector" Version="6.0.4" />
     <PackageVersion Include="bunit" Version="1.40.0" />
+    <!-- Transitive security pin (scadaproj#24): bunit 1.40.0 pulls AngleSharp 1.2.0 (NU1902,
+         GHSA-pgww-w46g-26qg). bUnit 2.x removes RenderComponent/AddTestAuthorization, so pin the
+         parser instead (same version Theme resolves via bUnit 2.7.2). -->
+    <PackageVersion Include="AngleSharp" Version="1.5.0" />
   </ItemGroup>
 
 </Project>