diff --git a/Directory.Packages.props b/Directory.Packages.props
index 9e34298f..6671c477 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -21,6 +21,8 @@
     <PackageVersion Include="System.Text.Encoding.CodePages" Version="10.0.9" />
     <PackageVersion Include="System.Text.Json" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.9" />
+    <!-- Pin native SQLite to non-vulnerable version (GHSA-2m69-gcr7-jv3q); transitive via Microsoft.Data.Sqlite -->
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="3.50.3" />
     <!-- CLI Dependencies -->
     <PackageVersion Include="System.CommandLine" Version="2.0.9" />
     <PackageVersion Include="Spectre.Console" Version="0.56.0" />
diff --git a/src/SharpDicom/SharpDicom.csproj b/src/SharpDicom/SharpDicom.csproj
index 56b9893c..29b76ab9 100644
--- a/src/SharpDicom/SharpDicom.csproj
+++ b/src/SharpDicom/SharpDicom.csproj
@@ -29,6 +29,8 @@
     <!-- In shared framework for net10.0+; NuGet correctly omits this dependency from the packed .nuspec for those TFMs (earlier TFMs still get the package dependency). -->
     <PackageReference Include="System.Text.Encoding.CodePages" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Pin native SQLite transitive dep to non-vulnerable version (GHSA-2m69-gcr7-jv3q) -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="System.Text.Json" />
   </ItemGroup>