diff --git a/src/RestoreGuard.Cli/RestoreGuard.Cli.csproj b/src/RestoreGuard.Cli/RestoreGuard.Cli.csproj
index 8397caf..216ad28 100644
--- a/src/RestoreGuard.Cli/RestoreGuard.Cli.csproj
+++ b/src/RestoreGuard.Cli/RestoreGuard.Cli.csproj
@@ -6,7 +6,7 @@
     <ProjectReference Include="..\RestoreGuard.Checks\RestoreGuard.Checks.csproj" />
     <!-- The ONLY runtime package dependency: the mongo report sink needs the wire
          protocol, which is not sanely hand-rollable (unlike the S3 sink's SigV4 PUTs). -->
-    <PackageReference Include="MongoDB.Driver" Version="3.10.0" />
+    <PackageReference Include="MongoDB.Driver" Version="3.12.0" />
     <!-- Transitive-only (wire compression, which we don't even enable): the driver
          pins vulnerable versions (NU1902/NU1903), so lift them to patched ones. -->
     <PackageReference Include="Snappier" Version="1.3.1" />
diff --git a/tests/RestoreGuard.Tests/RestoreGuard.Tests.csproj b/tests/RestoreGuard.Tests/RestoreGuard.Tests.csproj
index e3ab220..6341123 100644
--- a/tests/RestoreGuard.Tests/RestoreGuard.Tests.csproj
+++ b/tests/RestoreGuard.Tests/RestoreGuard.Tests.csproj
@@ -8,8 +8,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="10.0.1" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="coverlet.collector" Version="10.1.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>