diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92766ec..92ae5bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@
 
 Update the aspnet runtime base image to 10.0.12 to fix openssl vulnerabilities SNYK-UBUNTU2404-OPENSSL-17268920 and SNYK-UBUNTU2404-OPENSSL-20267014
 
+Treat NuGet restore warnings as errors
+
 ## 0.1.0
 
 Initial release
diff --git a/content/Directory.Build.props b/content/Directory.Build.props
index 81508dc..addaae2 100644
--- a/content/Directory.Build.props
+++ b/content/Directory.Build.props
@@ -3,7 +3,9 @@
     <LangVersion>latest</LangVersion>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <TreatWarningsAsErrors Condition="'$(Configuration)' == 'Release'">true</TreatWarningsAsErrors>
+    <!-- MSBuildRestoreSessionId is only set during restore; without it NuGet's NU* warnings are never escalated,
+         since CI and the Dockerfile restore before switching to the Release configuration. -->
+    <TreatWarningsAsErrors Condition="'$(Configuration)' == 'Release' or '$(MSBuildRestoreSessionId)' != ''">true</TreatWarningsAsErrors>
     <AnalysisMode>Recommended</AnalysisMode>
   </PropertyGroup>
 </Project>
\ No newline at end of file