diff --git a/src/Fable.Cli/Fable.Cli.fsproj b/src/Fable.Cli/Fable.Cli.fsproj
index ccebcc7f3..be0299a88 100644
--- a/src/Fable.Cli/Fable.Cli.fsproj
+++ b/src/Fable.Cli/Fable.Cli.fsproj
@@ -43,6 +43,10 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Buildalyzer" Version="8.0.0-fable-001" />
+    <!-- Pin Microsoft.Build transitive dependencies to fix CVE-2025-55247 (GHSA-w3q9-fxm7-j8fq) -->
+    <PackageReference Include="Microsoft.Build" Version="17.10.46" />
+    <PackageReference Include="Microsoft.Build.Tasks.Core" Version="17.10.46" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="17.10.46" />
     <PackageReference Include="EasyBuild.PackageReleaseNotes.Tasks" Version="2.0.0">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>