diff --git a/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj b/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj
index 64abc31..e33774d 100644
--- a/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj
+++ b/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj
@@ -19,7 +19,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.15" />
     <PackageReference Include="MongoDB.Driver" Version="3.13.0" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.15" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="11.0.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/src/ProCoderJi.Api/packages.lock.json b/backend/src/ProCoderJi.Api/packages.lock.json
index 9ee392a..55e96e2 100644
--- a/backend/src/ProCoderJi.Api/packages.lock.json
+++ b/backend/src/ProCoderJi.Api/packages.lock.json
@@ -83,9 +83,12 @@
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Direct",
-        "requested": "[10.0.15, )",
-        "resolved": "10.0.15",
-        "contentHash": "4jEv/lXDuQkh60lPU3hlwASErXdv1ZMKmsxVuBfZWiVKT5Q2QGo58kTa6rN519+PU+m4Hsj1m3yT8fN+Xw0XZw=="
+        "requested": "[11.0.0, )",
+        "resolved": "11.0.0",
+        "contentHash": "G8mTjSWrwaPJ2bJRbKuI4ZqdKUYcANK0KtNH3s8/va3nXiF/Pk/yhv2R17rv5PBKJO5+ZXDyhTnZXh0W9v0J8w==",
+        "dependencies": {
+          "System.Formats.Asn1": "11.0.0"
+        }
       },
       "Azure.Core": {
         "type": "Transitive",
@@ -477,6 +480,11 @@
           "System.Security.Cryptography.ProtectedData": "9.0.11"
         }
       },
+      "System.Formats.Asn1": {
+        "type": "Transitive",
+        "resolved": "11.0.0",
+        "contentHash": "RSIrJ7D8gEHykZWTfS/r9tz/G5YpxIQAaFFXSLLHhVaRed+/26KvqaXvUtqqMJMlNjubAcMvf3UJ+E6ABT8AWw=="
+      },
       "System.IdentityModel.Tokens.Jwt": {
         "type": "Transitive",
         "resolved": "7.7.1",
diff --git a/backend/tests/ProCoderJi.Api.Tests/packages.lock.json b/backend/tests/ProCoderJi.Api.Tests/packages.lock.json
index b7a7b50..7984f83 100644
--- a/backend/tests/ProCoderJi.Api.Tests/packages.lock.json
+++ b/backend/tests/ProCoderJi.Api.Tests/packages.lock.json
@@ -724,6 +724,11 @@
         "resolved": "10.0.15",
         "contentHash": "d1ynyO/BvCyi8SI1m6/xASazxrZm20V/mTDJay4qmL947RsA5MEiMk1JWvafw6JX005VVBAHvjWQP1dRRBvYKw=="
       },
+      "System.Formats.Asn1": {
+        "type": "Transitive",
+        "resolved": "11.0.0",
+        "contentHash": "RSIrJ7D8gEHykZWTfS/r9tz/G5YpxIQAaFFXSLLHhVaRed+/26KvqaXvUtqqMJMlNjubAcMvf3UJ+E6ABT8AWw=="
+      },
       "System.IdentityModel.Tokens.Jwt": {
         "type": "Transitive",
         "resolved": "7.7.1",
@@ -740,8 +745,11 @@
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
-        "resolved": "10.0.15",
-        "contentHash": "4jEv/lXDuQkh60lPU3hlwASErXdv1ZMKmsxVuBfZWiVKT5Q2QGo58kTa6rN519+PU+m4Hsj1m3yT8fN+Xw0XZw=="
+        "resolved": "11.0.0",
+        "contentHash": "G8mTjSWrwaPJ2bJRbKuI4ZqdKUYcANK0KtNH3s8/va3nXiF/Pk/yhv2R17rv5PBKJO5+ZXDyhTnZXh0W9v0J8w==",
+        "dependencies": {
+          "System.Formats.Asn1": "11.0.0"
+        }
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "Transitive",
@@ -810,7 +818,7 @@
           "Microsoft.EntityFrameworkCore.Sqlite": "[10.0.15, )",
           "MongoDB.Driver": "[3.13.0, )",
           "Npgsql.EntityFrameworkCore.PostgreSQL": "[10.0.3, )",
-          "System.Security.Cryptography.Pkcs": "[10.0.15, )"
+          "System.Security.Cryptography.Pkcs": "[11.0.0, )"
         }
       }
     }
diff --git a/backend/tests/ProCoderJi.BrowserHost/packages.lock.json b/backend/tests/ProCoderJi.BrowserHost/packages.lock.json
index 4e7837e..efd2218 100644
--- a/backend/tests/ProCoderJi.BrowserHost/packages.lock.json
+++ b/backend/tests/ProCoderJi.BrowserHost/packages.lock.json
@@ -353,6 +353,11 @@
           "System.Security.Cryptography.ProtectedData": "9.0.11"
         }
       },
+      "System.Formats.Asn1": {
+        "type": "Transitive",
+        "resolved": "11.0.0",
+        "contentHash": "RSIrJ7D8gEHykZWTfS/r9tz/G5YpxIQAaFFXSLLHhVaRed+/26KvqaXvUtqqMJMlNjubAcMvf3UJ+E6ABT8AWw=="
+      },
       "System.IdentityModel.Tokens.Jwt": {
         "type": "Transitive",
         "resolved": "7.7.1",
@@ -369,8 +374,11 @@
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
-        "resolved": "10.0.15",
-        "contentHash": "4jEv/lXDuQkh60lPU3hlwASErXdv1ZMKmsxVuBfZWiVKT5Q2QGo58kTa6rN519+PU+m4Hsj1m3yT8fN+Xw0XZw=="
+        "resolved": "11.0.0",
+        "contentHash": "G8mTjSWrwaPJ2bJRbKuI4ZqdKUYcANK0KtNH3s8/va3nXiF/Pk/yhv2R17rv5PBKJO5+ZXDyhTnZXh0W9v0J8w==",
+        "dependencies": {
+          "System.Formats.Asn1": "11.0.0"
+        }
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "Transitive",
@@ -446,7 +454,7 @@
           "Microsoft.EntityFrameworkCore.Sqlite": "[10.0.15, )",
           "MongoDB.Driver": "[3.13.0, )",
           "Npgsql.EntityFrameworkCore.PostgreSQL": "[10.0.3, )",
-          "System.Security.Cryptography.Pkcs": "[10.0.15, )"
+          "System.Security.Cryptography.Pkcs": "[11.0.0, )"
         }
       },
       "procoderji.api.tests": {
diff --git a/docs/maintainer-guide.md b/docs/maintainer-guide.md
index ab5a515..197b481 100644
--- a/docs/maintainer-guide.md
+++ b/docs/maintainer-guide.md
@@ -101,6 +101,13 @@ Merge one overlapping dependency change at a time. Let remaining branches refres
 their current diff and CI. Close a superseded update only after confirming that its changes are
 already included. Keep security updates visible; fewer routine PRs should not hide an urgent fix.
 
+For NuGet updates, refresh the complete solution with
+`dotnet restore backend/ProCoderJi.slnx --force-evaluate`, then verify
+`dotnet restore backend/ProCoderJi.slnx --locked-mode`. API or test dependencies also affect
+referencing projects, including `backend/tests/ProCoderJi.BrowserHost/`. Commit every changed
+`packages.lock.json` so clean CI restores use the same graph. Check the collector's required
+Test SDK version when updating Coverlet, and verify that CI records executed API lines.
+
 Follow [Security notes](security.md) for current known findings. Do not use `npm audit fix --force`,
 unrelated downgrades or broad overrides just to obtain a clean summary. New runtime dependencies
 need a concrete use and a discussion of their maintenance cost.