diff --git a/Directory.Build.props b/Directory.Build.props
index 6eb38c54d7a..9d84f1dc650 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -14,6 +14,8 @@
     <EnableNETAnalyzers>true</EnableNETAnalyzers>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <RepositoryUrl>https://github.com/dotnet/arcade</RepositoryUrl>
+    <!-- Only upgrade NuGetAudit warnings to errors for official builds. -->
+    <WarningsNotAsErrors Condition="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
   </PropertyGroup>
 
 </Project>
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 376184daed8..6969424cce0 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -38,6 +38,7 @@
     <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
     <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" />
     <PackageVersion Include="Microsoft.Build" Version="$(MicrosoftBuildVersion)" />
+    <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" /> <!-- Pin transitive dependency to avoid vulnerable 6.0.0 version. -->
     <!-- nuget -->
     <PackageVersion Include="NuGet.Commands" Version="$(NuGetCommandsVersion)" />
     <PackageVersion Include="NuGet.Frameworks" Version="$(NuGetFrameworksVersion)" />
@@ -83,7 +84,6 @@
     <PackageVersion Include="Microsoft.DataServices.Client" Version="$(MicrosoftDataServicesClientVersion)" />
     <PackageVersion Include="Microsoft.Diagnostics.Runtime" Version="1.0.5" />
     <PackageVersion Include="Microsoft.Identity.Client" Version="4.61.3" />
-    <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" />
     <PackageVersion Include="Microsoft.OpenApi" Version="1.3.2" />
     <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.3.2" />
     <PackageVersion Include="Microsoft.Signed.Wix" Version="$(MicrosoftSignedWixVersion)" />
diff --git a/NuGet.config b/NuGet.config
index 792ee1f6c03..2413842ee3f 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -14,6 +14,10 @@
     <add key="dotnet9" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json" />
     <add key="dotnet9-transport" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9-transport/nuget/v3/index.json" />
   </packageSources>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </auditSources>
   <disabledPackageSources>
     <clear />
   </disabledPackageSources>
diff --git a/eng/BuildTask.Packages.props b/eng/BuildTask.Packages.props
index 51e8b5641db..1c2d2a72e5e 100644
--- a/eng/BuildTask.Packages.props
+++ b/eng/BuildTask.Packages.props
@@ -8,7 +8,7 @@
     <PackageVersion Update="System.Reflection.MetadataLoadContext" Version="8.0.0" />
     <PackageVersion Update="System.Resources.Extensions" Version="8.0.0" />
     <PackageVersion Update="System.Text.Encodings.Web" Version="8.0.0" />
-    <PackageVersion Update="System.Text.Json" Version="8.0.0" />
+    <PackageVersion Update="System.Text.Json" Version="8.0.3" />
     <PackageVersion Update="System.Threading.Tasks.Dataflow" Version="8.0.0" />
 
     <!-- Packages that transitively bring above dependencies in. -->
@@ -18,4 +18,9 @@
     <PackageVersion Update="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
   </ItemGroup>
 
+  <!-- Suppress System.Text.Json/8.0.0 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.4). -->
+  <ItemGroup>
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
+  </ItemGroup>
+
 </Project>