diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index f3fccf3a..f5c8d92c 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -34,9 +34,9 @@
     <PackageVersion Include="Azure.ResourceManager.AppService" Version="1.2.0" />
     <!-- Microsoft Graph -->
     <PackageVersion Include="Microsoft.Graph" Version="5.36.0" />
-    <!-- Transitive pin: resolves NU1107 conflict between Microsoft.Extensions.Http 9.x (needs >= 9.0.8)
-         and Microsoft.Kiota.Abstractions 1.7.2 (needs < 9.0.0). CentralPackageTransitivePinningEnabled
-         allows this pin to override the Kiota upper bound. -->
+    <!-- Pin the transitive dependency to the version that fixes CVE-2026-44503. -->
+    <PackageVersion Include="Microsoft.Kiota.Abstractions" Version="1.22.2" />
+    <!-- Microsoft.Extensions.Http 9.x requires DiagnosticSource >= 9.0.8. -->
     <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="9.0.8" />
     <!-- Testing packages -->
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />