diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a02dc81..ad45688 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -39,3 +39,9 @@ updates:
       nuget-dependencies:
         patterns:
           - "*"
+    ignore:
+      # Microsoft.OpenApi 3.x breaks Microsoft.AspNetCore.OpenApi 10.0.x source generation
+      # (CS0200 on IOpenApiMediaType.Example). See TrainLoop.Api.csproj comment. Revisit
+      # once a stable AspNetCore.OpenApi release supports Microsoft.OpenApi 3.x.
+      - dependency-name: "Microsoft.OpenApi"
+        versions: [">=3.0.0"]
diff --git a/src/TrainLoop.Api/TrainLoop.Api.csproj b/src/TrainLoop.Api/TrainLoop.Api.csproj
index e07827d..dc2dffd 100644
--- a/src/TrainLoop.Api/TrainLoop.Api.csproj
+++ b/src/TrainLoop.Api/TrainLoop.Api.csproj
@@ -7,11 +7,19 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
+    <!-- Microsoft.OpenApi pinned to 2.7.5 (>= 2.7.5 clears GHSA-v5pm-xwqc-g5wc).
+         DO NOT bump to Microsoft.OpenApi 3.x while on Microsoft.AspNetCore.OpenApi 10.0.x:
+         AspNetCore.OpenApi 10.0.10's OpenApiXmlCommentSupport source generator targets the
+         mutable (pre-3.x) IOpenApiMediaType.Example setter, and Microsoft.OpenApi 3.x makes
+         Example read-only, causing CS0200 in generated code. The only AspNetCore.OpenApi
+         release compatible with Microsoft.OpenApi 3.x is 11.0.0-preview+ (net11.0, requires
+         .NET 11 preview SDK/runtime) — revisit this pin when .NET 11 GA ships a stable
+         release with matching Microsoft.OpenApi 3.x support. -->
     <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
   </ItemGroup>
 
diff --git a/src/TrainLoop.Infrastructure/TrainLoop.Infrastructure.csproj b/src/TrainLoop.Infrastructure/TrainLoop.Infrastructure.csproj
index 55dd7b7..43e4330 100644
--- a/src/TrainLoop.Infrastructure/TrainLoop.Infrastructure.csproj
+++ b/src/TrainLoop.Infrastructure/TrainLoop.Infrastructure.csproj
@@ -5,8 +5,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
diff --git a/src/TrainLoop.Worker/TrainLoop.Worker.csproj b/src/TrainLoop.Worker/TrainLoop.Worker.csproj
index bd0206b..7e69984 100644
--- a/src/TrainLoop.Worker/TrainLoop.Worker.csproj
+++ b/src/TrainLoop.Worker/TrainLoop.Worker.csproj
@@ -8,7 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/TrainLoop.Api.Tests/TrainLoop.Api.Tests.csproj b/tests/TrainLoop.Api.Tests/TrainLoop.Api.Tests.csproj
index bf5f351..3cee11b 100644
--- a/tests/TrainLoop.Api.Tests/TrainLoop.Api.Tests.csproj
+++ b/tests/TrainLoop.Api.Tests/TrainLoop.Api.Tests.csproj
@@ -9,7 +9,8 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <!-- Pinned to match TrainLoop.Api.csproj — see comment there for why 3.x is unsafe. -->
     <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
diff --git a/tests/TrainLoop.Core.Tests/TrainLoop.Core.Tests.csproj b/tests/TrainLoop.Core.Tests/TrainLoop.Core.Tests.csproj
index 70b74cf..70a28cd 100644
--- a/tests/TrainLoop.Core.Tests/TrainLoop.Core.Tests.csproj
+++ b/tests/TrainLoop.Core.Tests/TrainLoop.Core.Tests.csproj
@@ -9,7 +9,7 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>