diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e1c1039..6bf4aff 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -50,6 +50,10 @@ updates:
     ignore:
       - dependency-name: "Microsoft.EntityFrameworkCore*"
       - dependency-name: "Npgsql.EntityFrameworkCore.PostgreSQL*"
+      # Pinned for a SQLite advisory (#202). 3.x renames the native package, and
+      # Microsoft.Data.Sqlite 10 is built against 2.x.
+      - dependency-name: "SQLitePCLRaw.*"
+        update-types: [ "version-update:semver-major" ]
       - dependency-name: "System.Security.Cryptography.Xml"
       - dependency-name: "System.Security.Cryptography.Pkcs"
 
diff --git a/test/Directory.Build.targets b/test/Directory.Build.targets
index 7537dd0..da4391f 100644
--- a/test/Directory.Build.targets
+++ b/test/Directory.Build.targets
@@ -22,6 +22,9 @@
         <PackageReference Update="Microsoft.EntityFrameworkCore.Sqlite" Version="$(EfFloat)" />
         <PackageReference Update="Microsoft.EntityFrameworkCore.SqlServer" Version="$(EfFloat)" />
         <PackageReference Update="Microsoft.EntityFrameworkCore.Design" Version="$(EfFloat)" />
+        <!-- The SQLitePCLRaw pin exists for the floor (#202). A floated patch brings its own, and a
+             later one than the pin would fail the restore as a downgrade (NU1605). -->
+        <PackageReference Remove="SQLitePCLRaw.bundle_e_sqlite3" />
     </ItemGroup>
 
     <ItemGroup Condition="'$(NpgsqlEfFloat)' != ''">
diff --git a/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj b/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj
index 36020dc..f544a5f 100644
--- a/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj
+++ b/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj
@@ -22,6 +22,11 @@
             <PrivateAssets>none</PrivateAssets>
             <IncludeAssets>all</IncludeAssets>
         </PackageReference>
+        <!-- EF Core Sqlite 10.0.0 brings SQLitePCLRaw 2.1.11, whose native SQLite 3.49.1 has
+             CVE-2025-6965 (#202). 2.1.12 and later ship SQLite 3.53. Only the native library
+             moves: Microsoft.Data.Sqlite stays at the floor, and no package under src/ references
+             SQLite. test/Directory.Build.targets drops the pin when EF Core floats. -->
+        <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.14" />
         <PackageReference Include="MSTest" Version="4.5.1" />
         <PackageReference Include="Testcontainers.MsSql" Version="4.16.0" />
         <PackageReference Include="Testcontainers.PostgreSql" Version="4.16.0" />