diff --git a/Directory.Build.props b/Directory.Build.props
index 5733a78..4580fe7 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -8,4 +8,12 @@
     -->
     <NoWarn>$(NoWarn);NU1605</NoWarn>
   </PropertyGroup>
+
+  <!--
+    TRACKED: System.Security.Cryptography.Xml 8.0.2 has two High advisories (GHSA-37gx-xxp4-5rgx,
+    GHSA-w3x6-4m5h-cxqf — XML signature vulnerabilities). No patched version exists in the NuGet
+    feed as of 2026-06-14; 9.0.0 (the only higher version) is also flagged. Re-check when a
+    patched 8.x or 9.x build ships and pin here. Pulled in transitively by one of: Fido2, EPPlus,
+    Azure SDK, or VisualStudio.Web.CodeGeneration.Design.
+  -->
 </Project>