diff --git a/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj b/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj
index d0dc892..fd26a67 100644
--- a/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj
+++ b/src/PostQuantum.DataProtection/PostQuantum.DataProtection.csproj
@@ -67,9 +67,10 @@
   <ItemGroup>
     <!-- BouncyCastle is only needed on net8.0 and net9.0 — net10.0 uses System.Security.Cryptography.MLKem directly. -->
     <PackageReference Include="BouncyCastle.Cryptography" Version="2.6.2" Condition="'$(TargetFramework)' != 'net10.0'" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.9" />
     <PackageReference Include="PostQuantum.KeyManagement" Version="1.0.1" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection.Abstractions" Version="8.0.27" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection.Extensions" Version="8.0.27" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection.Abstractions" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection.Extensions" Version="10.0.9" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="8.0.2" />
     <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="8.0.11" />
@@ -84,7 +85,7 @@
       advisories (GHSA-37gx-xxp4-5rgx, GHSA-w3x6-4m5h-cxqf); we pin to the latest patched 8.0.x
       explicitly so a transitive resolution cannot land on the unpatched version under any nuget.
     -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.3" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.9" />
   </ItemGroup>
 
 </Project>
diff --git a/tests/PostQuantum.DataProtection.Tests/PostQuantum.DataProtection.Tests.csproj b/tests/PostQuantum.DataProtection.Tests/PostQuantum.DataProtection.Tests.csproj
index c3505b0..f54a03c 100644
--- a/tests/PostQuantum.DataProtection.Tests/PostQuantum.DataProtection.Tests.csproj
+++ b/tests/PostQuantum.DataProtection.Tests/PostQuantum.DataProtection.Tests.csproj
@@ -16,11 +16,11 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
     <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.1" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="8.0.27" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection.Extensions" Version="8.0.27" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection.Extensions" Version="10.0.9" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.9" />
     <PackageReference Include="PostQuantum.KeyManagement" Version="1.0.1" />
   </ItemGroup>