diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 41a357425a8..fd5274ed9c9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -64,6 +64,30 @@ jobs:
           sed -i "s/${current_version}/8.0/" src/global.json
         fi
 
+    # Frozen upstream revisions (release branches, and rebuild branches such as
+    # arm-tarball-fix-2.338.0) keep the NuGet package versions that upstream pinned when
+    # the revision was cut.  Upstream turns audit advisories into build errors
+    # (src/Directory.Build.props: NuGetAudit, NuGetAuditMode=all,
+    # NuGetAuditLevel=moderate, TreatWarningsAsErrors), so as soon as an advisory for one
+    # of those pins reaches NuGet's vulnerability feed, `dotnet restore` fails with
+    # NU1902/NU1903 and the revision can no longer be built at all.  That is what broke
+    # Runner CI run 38847871799.  Move the affected pins to the versions upstream already
+    # patched for those advisories (actions/runner#4777).  Pins that are not listed here
+    # still fail the build, so the audit keeps its signal.
+    - name: Bump NuGet packages with patched advisories
+      run: |
+        # CVE-2026-84008 (high, GHSA-846f-f764-76mx) and CVE-2026-70162 (moderate,
+        # GHSA-2fmv-rv2c-59x7) in System.Security.Cryptography.Pkcs affect 8.0.0-8.0.1,
+        # 9.0.0-9.0.20 and 10.0.0-10.0.12, patched in 8.0.2, 9.0.21 and 10.0.13.
+        # Each sed matches only an affected version, so the step is a no-op on revisions
+        # that already pin a patched version (current main pins 10.0.13).
+        sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="8\.0\.[01]"#System.Security.Cryptography.Pkcs" Version="8.0.2"#' src/Sdk/Sdk.csproj
+        sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="9\.0\.([0-9]|1[0-9]|20)"#System.Security.Cryptography.Pkcs" Version="9.0.21"#' src/Sdk/Sdk.csproj
+        sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="10\.0\.([0-9]|1[0-2])"#System.Security.Cryptography.Pkcs" Version="10.0.13"#' src/Sdk/Sdk.csproj
+        # Upstream bumps Formats.Asn1 in lockstep with Pkcs.
+        sed -i -E 's#System\.Formats\.Asn1" Version="10\.0\.([0-9]|1[0-2])"#System.Formats.Asn1" Version="10.0.13"#' src/Sdk/Sdk.csproj
+        grep -n -E 'System\.(Security\.Cryptography\.Pkcs|Formats\.Asn1)" Version=' src/Sdk/Sdk.csproj || true
+
     # Build runner layout
     - name: Build & Layout Release
       run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f8293d56fb..c3a45a8bd99 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -102,6 +102,30 @@ jobs:
           sed -i "s/${current_version}/8.0/" src/global.json
         fi
 
+    # Frozen upstream revisions (release branches, and rebuild branches such as
+    # arm-tarball-fix-2.338.0) keep the NuGet package versions that upstream pinned when
+    # the revision was cut.  Upstream turns audit advisories into build errors
+    # (src/Directory.Build.props: NuGetAudit, NuGetAuditMode=all,
+    # NuGetAuditLevel=moderate, TreatWarningsAsErrors), so as soon as an advisory for one
+    # of those pins reaches NuGet's vulnerability feed, `dotnet restore` fails with
+    # NU1902/NU1903 and the revision can no longer be built at all.  That is what broke
+    # Runner CI run 38847871799.  Move the affected pins to the versions upstream already
+    # patched for those advisories (actions/runner#4777).  Pins that are not listed here
+    # still fail the build, so the audit keeps its signal.
+    - name: Bump NuGet packages with patched advisories
+      run: |
+        # CVE-2026-84008 (high, GHSA-846f-f764-76mx) and CVE-2026-70162 (moderate,
+        # GHSA-2fmv-rv2c-59x7) in System.Security.Cryptography.Pkcs affect 8.0.0-8.0.1,
+        # 9.0.0-9.0.20 and 10.0.0-10.0.12, patched in 8.0.2, 9.0.21 and 10.0.13.
+        # Each sed matches only an affected version, so the step is a no-op on revisions
+        # that already pin a patched version (current main pins 10.0.13).
+        sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="8\.0\.[01]"#System.Security.Cryptography.Pkcs" Version="8.0.2"#' src/Sdk/Sdk.csproj
+        sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="9\.0\.([0-9]|1[0-9]|20)"#System.Security.Cryptography.Pkcs" Version="9.0.21"#' src/Sdk/Sdk.csproj
+        sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="10\.0\.([0-9]|1[0-2])"#System.Security.Cryptography.Pkcs" Version="10.0.13"#' src/Sdk/Sdk.csproj
+        # Upstream bumps Formats.Asn1 in lockstep with Pkcs.
+        sed -i -E 's#System\.Formats\.Asn1" Version="10\.0\.([0-9]|1[0-2])"#System.Formats.Asn1" Version="10.0.13"#' src/Sdk/Sdk.csproj
+        grep -n -E 'System\.(Security\.Cryptography\.Pkcs|Formats\.Asn1)" Version=' src/Sdk/Sdk.csproj || true
+
     # Build runner layout
     - name: Build & Layout Release
       run: |