diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index c4661c3054..6b3d4d4be6 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -99,6 +99,10 @@
     <PackageVersion Include="StackExchange.Redis" Version="2.13.17" />
     <PackageVersion Include="UAParser" Version="3.1.47" />
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8" />
+    <!-- Pinned above the transitive 2.0.0 pulled by AspNetCore.OpenApi/Scalar to clear advisory
+         GHSA-v5pm-xwqc-g5wc (circular-schema stack overflow). Transitive pinning is enabled, so this
+         floors Microsoft.OpenApi everywhere it resolves. -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.5.1" />
     <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.16.0" />
     <PackageVersion Include="Shouldly" Version="4.3.0" />