diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 76ae96b..14f61d4 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -42,7 +42,7 @@ jobs:
       # the build gate (exit-code 1) makes Trivy mark the SARIF invocation
       # unsuccessful whenever a finding exists, which GitHub surfaces as
       # "Trivy is reporting errors" / a code-scanning configuration error.
-      - uses: aquasecurity/trivy-action@master
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: config
           # Scoped to the Dockerfile — the one config artifact this repo owns
@@ -68,7 +68,7 @@ jobs:
       # step already downloaded (skip-db-update). Separate from the SARIF upload
       # so a finding fails CI without poisoning the code-scanning analysis.
       - name: gate on HIGH/CRITICAL
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: config
           scan-ref: Dockerfile
@@ -80,10 +80,19 @@ jobs:
   trivy-fs:
     name: trivy (filesystem vuln scan — npm deps)
     runs-on: ubuntu-latest
+    env:
+      # trivy's npm/pnpm parser drops dev dependencies unless told otherwise, so
+      # this job reported zero findings while the lockfile carried a fixable HIGH.
+      # A build-time dependency still executes in CI with repo credentials, which
+      # is the surface this gate exists to cover, and the sibling repos scanning
+      # the same tree with osv-scanner have always counted them — the two tools
+      # disagreed on the same advisory in the same org. trivy-action exposes no
+      # input for it; the flag is only reachable as its TRIVY_-prefixed env var.
+      TRIVY_INCLUDE_DEV_DEPS: "true"
     steps:
       - uses: actions/checkout@v4
       # Report step: always upload a clean SARIF (exit-code 0) — see trivy-config.
-      - uses: aquasecurity/trivy-action@master
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
@@ -105,7 +114,7 @@ jobs:
           category: trivy-fs
       # Gate step: fail the build on HIGH/CRITICAL, reusing the cached DB.
       - name: gate on HIGH/CRITICAL
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
diff --git a/package-lock.json b/package-lock.json
index f037451..f886970 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5694,9 +5694,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index 5e6817f..41e91a8 100644
--- a/package.json
+++ b/package.json
@@ -65,6 +65,7 @@
     "fast-uri": "^3.1.4",
     "form-data": "^4.0.6",
     "gaxios": "^7.3.0",
+    "nanoid": "^3.3.17",
     "postcss": "^8.5.15",
     "protobufjs": "^7.6.4",
     "qs": "^6.15.2",