diff --git a/Directory.Packages.props b/Directory.Packages.props
index c665218..7f99121 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,12 +1,15 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <AspireVersion>13.1.2</AspireVersion>
   </PropertyGroup>
 
   <!-- ASP.NET Core Dependencies -->
   <ItemGroup Label="ASP.NET Core">
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.7" />
+    <!-- Pin to patched version to avoid CVE-2026-49451 (stack overflow on circular schema refs). -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.7" />
   </ItemGroup>