diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 202a5239f..5ed951415 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -164,8 +164,7 @@ settings:
 
 overrides:
   handlebars: ^4.7.9
-  undici@>=7.0.0: ^8.9.0
-  undici@<6.27.0: ^8.9.0
+  undici@<8.10.2: ^8.10.2
   lodash-es: ^4.18.1
   form-data: ^4.0.6
   dompurify: ^3.4.11
@@ -6962,8 +6961,8 @@ packages:
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
-  undici@8.10.0:
-    resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==}
+  undici@8.11.2:
+    resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==}
     engines: {node: '>=22.19.0'}
 
   unicode-emoji-modifier-base@1.0.0:
@@ -7355,7 +7354,7 @@ snapshots:
   '@actions/http-client@4.0.1':
     dependencies:
       tunnel: 0.0.6
-      undici: 8.10.0
+      undici: 8.11.2
 
   '@actions/io@3.0.2': {}
 
@@ -7388,7 +7387,7 @@ snapshots:
       '@standard-schema/spec': 1.1.0
       '@workflow/serde': 4.1.0
       eventsource-parser: 3.1.1
-      undici: 8.10.0
+      undici: 8.11.2
       zod: 4.6.5
 
   '@ai-sdk/provider@4.0.21':
@@ -9317,7 +9316,7 @@ snapshots:
       p-filter: 4.1.0
       semantic-release: 25.0.9(supports-color@8.1.1)(typescript@7.0.2)
       tinyglobby: 0.2.17
-      undici: 8.10.0
+      undici: 8.11.2
       url-join: 5.0.0
     transitivePeerDependencies:
       - kerberos
@@ -12048,7 +12047,7 @@ snapshots:
       parse5: 8.0.1
       saxes: 6.0.0
       tough-cookie: 6.0.2
-      undici: 8.10.0
+      undici: 8.11.2
       w3c-xmlserializer: 6.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
@@ -14563,7 +14562,7 @@ snapshots:
 
   undici-types@7.24.6: {}
 
-  undici@8.10.0: {}
+  undici@8.11.2: {}
 
   unicode-emoji-modifier-base@1.0.0: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 987f90e67..4088d3576 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -30,12 +30,10 @@ overrides:
   # Force patched versions of stale transitive deps flagged by Dependabot.
   # All are transitive-only; bumping the minimum clears the advisories.
   handlebars: '^4.7.9'
-  # 8.9.0, not 8.0.0: CVE-2026-13697 (GHSA-4cwx-7wf7-3272), a shared-cache
-  # disclosure in undici's cache interceptor, is only patched from 8.9.0 on.
-  'undici@>=7.0.0': '^8.9.0'
-  # undici 6.x still comes in via semantic-release's @actions/http-client, which
-  # declares ^6.23.0 as of 4.0.1; drop this and it resolves back down to 6.28.0.
-  'undici@<6.27.0': '^8.9.0'
+  # 8.10.2 is jsdom 30.1's own floor and patches GHSA-vp8m-p9jh-q5pm and ten sibling
+  # advisories. Keep the selector `<floor`: pnpm overrides each declared range that
+  # overlaps it, so it lifts every range that can resolve below the floor and none above.
+  'undici@<8.10.2': '^8.10.2'
   lodash-es: '^4.18.1'
   form-data: '^4.0.6'
   dompurify: '^3.4.11'