diff --git a/CHANGELOG.md b/CHANGELOG.md
index afe530b..28acb94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,9 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-_Nothing yet._
+### Changed
+- Aspire moved from 13.5.2 to 13.6.4, and Microsoft.Extensions.* and EF Core packages from 10.0.11 to 10.0.12 — the floor Aspire 13.6 requires.
+- Microsoft.Data.SqlClient (integration tests and sample only) moved from 6.1.6 to 6.1.8, which takes System.Security.Cryptography.Pkcs 9.0.21 and clears CVE-2026-70162 and CVE-2026-84008.
 
 ## [1.0.0-preview.2] — 2026-10-10
 
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 73276d1..21af109 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -5,38 +5,38 @@
   </PropertyGroup>
 
   <ItemGroup Label="Microsoft">
-    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.12" />
     <PackageVersion Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.3.12" />
-    <!-- 10.0.11 across the board: the first Microsoft.AspNetCore.OpenApi release that
-         requires the patched Microsoft.OpenApi [2.7.5, 3.0.0) (GHSA-v5pm-xwqc-g5wc), and
-         the floor that the Aspire 13.5 client integrations ask for. -->
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
+    <!-- 10.0.12 across the board: the floor that Aspire 13.6 asks for. Never below 10.0.11,
+         the first Microsoft.AspNetCore.OpenApi release that requires the patched
+         Microsoft.OpenApi [2.7.5, 3.0.0) (GHSA-v5pm-xwqc-g5wc). -->
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.400" />
   </ItemGroup>
 
   <ItemGroup Label="Aspire — AppHost (orchestration)">
-    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.5.2" />
-    <PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="13.5.2" />
-    <PackageVersion Include="Aspire.Hosting.Redis" Version="13.5.2" />
-    <PackageVersion Include="Aspire.Hosting.JavaScript" Version="13.5.2" />
+    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.6.4" />
+    <PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="13.6.4" />
+    <PackageVersion Include="Aspire.Hosting.Redis" Version="13.6.4" />
+    <PackageVersion Include="Aspire.Hosting.JavaScript" Version="13.6.4" />
     <!-- Referenced only when the matching provider block in AppHost.cs is uncommented. -->
-    <PackageVersion Include="Aspire.Hosting.MongoDB" Version="13.5.2" />
-    <PackageVersion Include="Aspire.Hosting.SqlServer" Version="13.5.2" />
+    <PackageVersion Include="Aspire.Hosting.MongoDB" Version="13.6.4" />
+    <PackageVersion Include="Aspire.Hosting.SqlServer" Version="13.6.4" />
   </ItemGroup>
 
   <ItemGroup Label="Aspire — client integrations (consumed by the API)">
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <!-- Backs the AddDbContextCheck<AppDbContext>() readiness probe in samples/SampleApp. -->
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore" Version="10.0.11" />
-    <PackageVersion Include="Aspire.StackExchange.Redis" Version="13.5.2" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="Aspire.StackExchange.Redis" Version="13.6.4" />
     <!-- Referenced only when the matching provider block in Program.cs is uncommented. -->
-    <PackageVersion Include="Aspire.Npgsql" Version="13.5.2" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.11" />
+    <PackageVersion Include="Aspire.Npgsql" Version="13.6.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.12" />
   </ItemGroup>
 
   <ItemGroup Label="Aspire — service defaults (telemetry, resilience, discovery)">
@@ -80,7 +80,7 @@
     <PackageVersion Include="Testcontainers.PostgreSql" Version="4.14.0" />
     <PackageVersion Include="Testcontainers.MongoDb" Version="4.14.0" />
     <PackageVersion Include="Testcontainers.MsSql" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.6" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.8" />
   </ItemGroup>
 
   <ItemGroup Label="Testing">
@@ -111,11 +111,11 @@
   </ItemGroup>
 
   <ItemGroup Label="EF Core / ASP.NET Core — net10.0" Condition="'$(_Net8)' != 'true'">
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.12" />
   </ItemGroup>
 </Project>
diff --git a/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj b/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj
index d3a8621..a915e22 100644
--- a/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj
+++ b/aspire/DotNetBoost.Settings.AppHost/DotNetBoost.Settings.AppHost.csproj
@@ -2,7 +2,7 @@
 
   <!-- Turns this project into an Aspire AppHost: generates the strongly typed
        `Projects.*` handles used by AddProject<T>() and the `aspire run` entry point. -->
-  <Sdk Name="Aspire.AppHost.Sdk" Version="13.5.2" />
+  <Sdk Name="Aspire.AppHost.Sdk" Version="13.6.4" />
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>