diff --git a/app/Build/Build Script.csproj b/app/Build/Build Script.csproj
index 5694b509..5a184f2d 100644
--- a/app/Build/Build Script.csproj	
+++ b/app/Build/Build Script.csproj	
@@ -12,6 +12,9 @@
 
     <ItemGroup>
       <PackageReference Include="Cocona" Version="2.2.0" />
+
+      <!-- Pins Cocona's transitive Microsoft.Extensions.Hosting 6.0.0, which pulled in the vulnerable System.Text.Json 6.0.0 (GHSA-8g4q-xg66-9fp4) -->
+      <PackageReference Include="Microsoft.Extensions.Hosting" Version="9.0.18" />
     </ItemGroup>
 
     <ItemGroup>
diff --git a/app/Directory.Build.props b/app/Directory.Build.props
new file mode 100644
index 00000000..a3c7e870
--- /dev/null
+++ b/app/Directory.Build.props
@@ -0,0 +1,8 @@
+<Project>
+
+    <PropertyGroup>
+        <!-- Audit direct and transitive packages, so vulnerable transitive dependencies surface during restore instead of only in the IDE -->
+        <NuGetAuditMode>all</NuGetAuditMode>
+    </PropertyGroup>
+
+</Project>
\ No newline at end of file