diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95ffa08ccba..2df8239b65e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -137,9 +137,18 @@ jobs:
             <packageSources>
               <!-- Local NuGet repositories -->
               <add key="Local SpacetimeDB.BSATN.Runtime" value="../crates/bindings-csharp/BSATN.Runtime/bin/Release" />
-              <!-- Official NuGet.org server -->
-              <add key="NuGet.org" value="https://api.nuget.org/v3/index.json" />
             </packageSources>
+            <packageSourceMapping>
+              <!-- Ensure that SpacetimeDB.BSATN.Runtime is used from the local folder. -->
+              <!-- Otherwise we risk an outdated version being quietly pulled from NuGet for testing. -->
+              <packageSource key="Local SpacetimeDB.BSATN.Runtime">
+                <package pattern="SpacetimeDB.BSATN.Runtime" />
+              </packageSource>
+              <!-- Fallback to NuGet for other packages. -->
+              <packageSource key="nuget.org">
+                <package pattern="*" />
+              </packageSource>
+            </packageSourceMapping>
           </configuration>
           EOF
 
diff --git a/smoketests/tests/csharp_module.py b/smoketests/tests/csharp_module.py
index 6eda4e2ce4f..6207994a46e 100644
--- a/smoketests/tests/csharp_module.py
+++ b/smoketests/tests/csharp_module.py
@@ -4,6 +4,7 @@
 from pathlib import Path
 import shutil
 import subprocess
+import xml.etree.ElementTree as xml
 
 
 @requires_dotnet
@@ -26,20 +27,28 @@ def test_build_csharp_module(self):
 
                 packed_projects = ["BSATN.Runtime", "Runtime"]
 
-                config = []
-                config.append("<?xml version=\"1.0\" encoding=\"utf-8\"?>")
-                config.append("<configuration>")
-                config.append("<packageSources>")
-                config.append("<!-- Local NuGet repositories -->")
+                config = xml.Element("configuration")
+
+                sources = xml.SubElement(config, "packageSources")
+                mappings = xml.SubElement(config, "packageSourceMapping")
+
                 for project in packed_projects:
+                    # Add local build directories as NuGet repositories.
                     path = bindings / project / "bin" / "Release"
-                    config.append("<add key=\"Local %s\" value=\"%s\" />\n" % (project, str(path)))
-                config.append("<!-- Official NuGet.org server -->")
-                config.append("<add key=\"NuGet.org\" value=\"https://api.nuget.org/v3/index.json\" />")
-                config.append("</packageSources>")
-                config.append("</configuration>")
+                    project = f"SpacetimeDB.{project}"
+                    xml.SubElement(sources, "add", key=project, value=str(path))
+
+                    # Add strict package source mappings to ensure that
+                    # SpacetimeDB.* packages are used from those directories
+                    # and never from nuget.org.
+                    #
+                    # This prevents bugs where we silently used an outdated
+                    # version which led to tests passing when they shouldn't.
+                    mapping = xml.SubElement(mappings, "packageSource", key=project)
+                    xml.SubElement(mapping, "package", pattern=project)
 
-                config = "\n".join(config)
+                xml.indent(config)
+                config = xml.tostring(config, encoding="unicode", xml_declaration=True)
 
                 print("Writing `nuget.config` contents:")
                 print(config)