diff --git a/CHANGELOG.md b/CHANGELOG.md
index fedfba64584..fe466354a3c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Fixed
+
+- **CUMULUS-5455**
+  - Added `pacote` override (`^21.5.1`) to address https://github.com/advisories/GHSA-w4pp-8pjf-rmxw (CVE-2026-9496)
+
 ### Added
 
 - **CUMULUS-5256**
diff --git a/package.json b/package.json
index 336ed30bdb0..6edc89ef9c1 100644
--- a/package.json
+++ b/package.json
@@ -198,6 +198,7 @@
     "minimatch@7": "^7.4.9",
     "minimatch@9": "^9.0.9",
     "minimatch@10": "^10.2.6",
+    "pacote": "^21.5.1",
     "request": {
       "qs": "^6.14.1"
     },