diff --git a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs
index 6a6badba..c91a77e6 100644
--- a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs
+++ b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs
@@ -16,5 +16,9 @@ public class TodoItemController : TableController<TodoItem>
     public TodoItemController(AppDbContext context) 
         : base(new EntityTableRepository<TodoItem>(context))
     {
+        // UnsafeEntityLogging is intentionally left at its secure default (false).
+        // This sample stores user-supplied TodoItem content (Title), so only the
+        // entity ID is logged; the full serialized entity is never written to the logs.
+        Options = new TableControllerOptions { UnsafeEntityLogging = false };
     }
 }
\ No newline at end of file
diff --git a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs
index 830eeaa3..084333a5 100644
--- a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs
+++ b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs
@@ -15,6 +15,9 @@ public class TodoListController : TableController<TodoList>
 {
     public TodoListController(AppDbContext context) : base(new EntityTableRepository<TodoList>(context))
     {
-        Options = new TableControllerOptions { EnableSoftDelete = true };
+        // UnsafeEntityLogging is intentionally left at its secure default (false).
+        // This sample stores user-supplied TodoList content (Title), so only the
+        // entity ID is logged; the full serialized entity is never written to the logs.
+        Options = new TableControllerOptions { EnableSoftDelete = true, UnsafeEntityLogging = false };
     }
 }
\ No newline at end of file
diff --git a/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj b/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj
index b15c196e..dc0d0f1e 100644
--- a/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj
+++ b/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj
@@ -7,12 +7,21 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.3">
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.9">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+
+    <!--
+      Microsoft.AspNetCore.OData (a transitive dependency via CommunityToolkit.Datasync.Server) floats
+      Microsoft.OData.Edm to a lower version than the one CommunityToolkit.Datasync.Server.Abstractions
+      already pins Microsoft.Spatial to. Pin it explicitly here to keep the resolved assembly versions
+      consistent, matching the src/Directory.Packages.props ODataVersion.
+    -->
+    <PackageReference Include="Microsoft.OData.Core" Version="8.4.3" />
+    <PackageReference Include="Microsoft.OData.Edm" Version="8.4.3" />
   </ItemGroup>
 
   <ItemGroup>