diff --git a/Directory.Packages.props b/Directory.Packages.props
index 73da463c..dd74b353 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -36,6 +36,8 @@
     <!-- Analyzer Testing (pinned to match Microsoft.CodeAnalysis.CSharp 5.0.0) -->
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.4" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.CodeFix.Testing" Version="1.1.4" />
+    <!-- Pin vulnerable transitive dep of NuGet.Packaging via analyzer testing packages (GHSA-2fmv-rv2c-59x7) -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
     <!-- MongoDB Integration (v3.x targets netstandard2.1/net6.0+, NOT netstandard2.0) -->
     <PackageVersion Include="MongoDB.Driver" Version="3.12.0" />
     <!-- Pin vulnerable transitive deps of MongoDB.Driver (GHSA-6c8g-7p36-r338, GHSA-pggp-6c3x-2xmx) -->
diff --git a/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj b/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj
index 98130eb5..1b01a328 100644
--- a/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj
+++ b/tests/SharpDicom.Analyzers.Tests/SharpDicom.Analyzers.Tests.csproj
@@ -31,6 +31,8 @@
     -->
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" />
+    <!-- Override vulnerable System.Security.Cryptography.Pkcs 9.0.6 from NuGet.Packaging (GHSA-2fmv-rv2c-59x7) -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>