diff --git a/src/DevBrain.Functions/DevBrain.Functions.csproj b/src/DevBrain.Functions/DevBrain.Functions.csproj
index 30dedbf..1928129 100644
--- a/src/DevBrain.Functions/DevBrain.Functions.csproj
+++ b/src/DevBrain.Functions/DevBrain.Functions.csproj
@@ -18,7 +18,7 @@
     <PackageReference Include="Microsoft.Azure.Cosmos" Version="3.58.0" />
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
     <PackageReference Include="Microsoft.Extensions.Azure" Version="1.13.1" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.0" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />
     <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.5.1" />
     <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Keys" Version="1.6.1" />
     <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.17.0" />
@@ -29,7 +29,7 @@
          stay on 10.0.0 for the runtime library. System.Security.Cryptography.Xml 10.0.5 and below
          carry CVE-2026-33116 + CVE-2026-26171 (DoS), patched in 10.0.6 — pin directly here to floor
          the transitive dep without pulling DataProtection forward. Revisit when 10.0.7+ ships. -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.6" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.7" />
   </ItemGroup>
 
   <ItemGroup>