diff --git a/squip-api/src/Squip.Rest/Squip.Rest.csproj b/squip-api/src/Squip.Rest/Squip.Rest.csproj
index 23617de..724452b 100644
--- a/squip-api/src/Squip.Rest/Squip.Rest.csproj
+++ b/squip-api/src/Squip.Rest/Squip.Rest.csproj
@@ -22,7 +22,7 @@
     </PackageReference>
     <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="10.0.2" />
     <!-- Transitive pins: CodeGeneration.Design pulls 6.12.1, vulnerable to GHSA-g4vj-cjjj-v7hg -->
-    <PackageReference Include="NuGet.Packaging" Version="6.12.5" />
+    <PackageReference Include="NuGet.Packaging" Version="7.9.0" />
     <PackageReference Include="NuGet.Protocol" Version="6.12.5" />
     <PackageReference Include="NodaTime" Version="3.3.0" />
     <PackageReference Include="NodaTime.Serialization.JsonNet" Version="3.2.0" />