diff --git a/package.json b/package.json
index 09009e6..0f28ce4 100644
--- a/package.json
+++ b/package.json
@@ -30,13 +30,5 @@
     "@biomejs/biome": "2.5.6",
     "@nanohype/error-pages": "^0.1.0",
     "typescript": "^6.0.3"
-  },
-  "pnpm": {
-    "overrides": {
-      "postcss": ">=8.5.18",
-      "nanoid": "^3.3.17",
-      "fast-uri": ">=4.1.2",
-      "js-yaml@4": "^4.3.1"
-    }
   }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..be34331
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,38 @@
+# pnpm settings live here, not in package.json.
+#
+# pnpm 11 stopped reading the `pnpm` field in package.json entirely, and it does
+# so without failing — it prints "The following keys were ignored" and installs
+# anyway. An override block left behind in package.json therefore stops applying
+# the moment the package manager is bumped, and the tree silently relocks onto
+# the versions these floors exist to keep out. pnpm 10 already reads this file,
+# so the settings live in one place across both.
+#
+# Every entry below is a floor over a transitive dependency, not a direct one:
+# nothing here appears in package.json, and each was added because osv-scanner
+# — a required check — went red on the resolved lockfile.
+
+overrides:
+  # Clears the osv-scanner gate on the resolved tree; postcss arrives via astro.
+  postcss: ">=8.5.18"
+
+  # GHSA-2v37-7h3g-55p8 (CVSS 8.2) — a custom generator loops indefinitely when
+  # size is zero. Reached through postcss.
+  #
+  # The caret is load-bearing and must not be relaxed to `>=`: the open-ended
+  # form resolves to nanoid 6, which is ESM-only and is not the API postcss
+  # calls. The caret keeps the fix inside the 3.x line the parent supports.
+  nanoid: "^3.3.17"
+
+  # GHSA-7p8r-x3mc-p8w7 (HIGH) — host confusion; a URL whose authority is
+  # introduced with a backslash parses to a different host than a resolver
+  # reaches. The advisory patches 4.x at 4.1.2 and 3.x at 3.1.5 separately;
+  # this tree resolves 4.x, so 4.1.2 is the correct floor here.
+  fast-uri: ">=4.1.2"
+
+  # GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 in js-yaml 3.x and 4.x below 4.3.1.
+  #
+  # Scoped to the 4.x line deliberately. astro 7 and Starlight pull js-yaml 5.x,
+  # which the advisory does not cover: an unscoped `^4.3.1` drags the site's own
+  # frontmatter parser down a major version, and an unbounded `>=4.3.1` collapses
+  # both lines to 5.x. The scoped form moves only the vulnerable resolution.
+  js-yaml@4: "^4.3.1"