diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ed0228b..4a17767 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,6 +12,7 @@ overrides:
   vite: 6.4.3
   postcss: 8.5.15
   uuid: 11.1.1
+  js-yaml: 3.15.0
 
 importers:
 
@@ -1224,8 +1225,8 @@ packages:
     resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
     hasBin: true
 
-  js-yaml@3.14.2:
-    resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==}
+  js-yaml@3.15.0:
+    resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==}
     hasBin: true
 
   katex@0.16.28:
@@ -2848,7 +2849,7 @@ snapshots:
 
   gray-matter@4.0.3:
     dependencies:
-      js-yaml: 3.14.2
+      js-yaml: 3.15.0
       kind-of: 6.0.3
       section-matter: 1.0.0
       strip-bom-string: 1.0.0
@@ -2893,7 +2894,7 @@ snapshots:
 
   jiti@2.6.1: {}
 
-  js-yaml@3.14.2:
+  js-yaml@3.15.0:
     dependencies:
       argparse: 1.0.10
       esprima: 4.0.1
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 4de1be5..5ae8d5c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -13,20 +13,12 @@ overrides:
   vite: 6.4.3 # was 6.4.2 — GHSA-fx2h-pf6j-xcff (high), GHSA-v6wh-96g9-6wx3
   postcss: 8.5.15 # GHSA-qx2v-qp2m-jg93 (via vite)
   uuid: 11.1.1 # GHSA-w5hq-g745-h8pq (via mermaid; stays in mermaid's ^11 range)
+  js-yaml: 3.15.0 # GHSA-h67p-54hq-rp68 quadratic-DoS via merge-key aliases (via gray-matter; stays in its ^3.13.1 range)
 
 peerDependencyRules:
   allowedVersions:
     vitepress: "2"
 
-auditConfig:
-  ignoreGhsas:
-    # js-yaml 3.x quadratic-DoS via merge-key aliases (CVE-2026-53550).
-    # gray-matter@4.0.3 hard-pins js-yaml 3.x (uses safeLoad/safeDump, removed
-    # in 4.x) and has no newer release; the fix only landed in js-yaml >=4.2.0,
-    # so 3.x cannot be patched. js-yaml here only parses this repo's own
-    # build-time frontmatter (trusted input), so the DoS is not reachable.
-    - GHSA-h67p-54hq-rp68
-
 # Build scripts left disabled (matching prior pnpm 10 behavior — neither was
 # ever approved, and the site builds fine without them). Flip to true to allow.
 allowBuilds: