diff --git a/src/Ecommerce.AppHost/Ecommerce.AppHost.csproj b/src/Ecommerce.AppHost/Ecommerce.AppHost.csproj
index bf2dd17..0f05380 100644
--- a/src/Ecommerce.AppHost/Ecommerce.AppHost.csproj
+++ b/src/Ecommerce.AppHost/Ecommerce.AppHost.csproj
@@ -10,7 +10,7 @@
         <PackageReference Include="MicroElements.AspNetCore.OpenApi.FluentValidation" Version="7.1.8" />
         <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.2" />
         <!-- Pin above the transitive Microsoft.AspNetCore.OpenApi floor (2.0.0) to clear GHSA-v5pm-xwqc-g5wc / CVE-2026-49451. -->
-        <PackageReference Include="Microsoft.OpenApi" Version="2.9.0" />
+        <PackageReference Include="Microsoft.OpenApi" Version="3.9.0" />
         <PackageReference Include="Scalar.AspNetCore" Version="2.16.10" />
     </ItemGroup>
 
diff --git a/src/Ecommerce.Kernel/Ecommerce.Kernel.API/Ecommerce.Kernel.API.csproj b/src/Ecommerce.Kernel/Ecommerce.Kernel.API/Ecommerce.Kernel.API.csproj
index b1de009..4f93d16 100644
--- a/src/Ecommerce.Kernel/Ecommerce.Kernel.API/Ecommerce.Kernel.API.csproj
+++ b/src/Ecommerce.Kernel/Ecommerce.Kernel.API/Ecommerce.Kernel.API.csproj
@@ -13,7 +13,7 @@
     <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.1" />
     <PackageReference Include="MicroElements.AspNetCore.OpenApi.FluentValidation" Version="7.1.8" />
     <!-- Pin above the transitive Microsoft.AspNetCore.OpenApi floor (2.0.0) to clear GHSA-v5pm-xwqc-g5wc / CVE-2026-49451. -->
-    <PackageReference Include="Microsoft.OpenApi" Version="2.9.0" />
+    <PackageReference Include="Microsoft.OpenApi" Version="3.9.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.5" />
   </ItemGroup>