diff --git a/.dockerignore b/.dockerignore
index f2f85e98..215214d8 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -26,6 +26,7 @@ credentials/
 jest.config*
 tsconfig*.json
 !tsconfig.build.json
+!tsconfig.json
 
 # ── Dependencies (rebuilt inside image) ───────────────────────────────────────
 node_modules/
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 7645938a..2ca40725 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -34,7 +34,6 @@ jobs:
   dependency-scan:
     name: Dependency Scan
     runs-on: ubuntu-latest
-    if: hashFiles('package.json', 'pnpm-lock.yaml') != ''
 
     steps:
       - name: Checkout code
@@ -55,7 +54,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Audit dependencies (fail only on critical)
-        run: pnpm audit --audit-level=critical
+        run: pnpm audit --audit-level=critical --prod
 
   secrets-scan:
     name: Secrets Scan (Gitleaks)
@@ -67,13 +66,20 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
+            | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+
       - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
+        run: |
+          gitleaks detect --source=. --exit-code 1 \
+            --log-opts="origin/${{ github.base_ref }}..HEAD"
 
   container-scan:
     name: Container Scan (Trivy)
     runs-on: ubuntu-latest
-    if: hashFiles('Dockerfile') != ''
 
     steps:
       - name: Checkout code
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index efe7238b..933d3c26 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,9 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  protobufjs: '>=7.5.5'
+
 importers:
 
   .:
@@ -5563,10 +5566,6 @@ packages:
     resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==}
     engines: {node: '>= 6'}
 
-  protobufjs@6.11.6:
-    resolution: {integrity: sha512-k8BHqgPBOtrlougZZqF2uUk5Z7bN8f0wj+3e8M3hvtSv0NBAz4VBy5f6R5Nxq/l+i7mRFTgNZb2trxqTpHNY/A==}
-    hasBin: true
-
   protobufjs@7.6.2:
     resolution: {integrity: sha512-N9EiLovGEQOJSPF26Ij7qUGvahfEnq0eeYZ02aigIedkmz1qZSwjnP9SBITHJuF/6MYbIW4HDN8zdYjsjqJKXQ==}
     engines: {node: '>=12.0.0'}
@@ -12508,7 +12507,7 @@ snapshots:
 
   onnx-proto@4.0.4:
     dependencies:
-      protobufjs: 6.11.6
+      protobufjs: 7.6.2
 
   onnxruntime-common@1.14.0: {}
 
@@ -12786,22 +12785,6 @@ snapshots:
       kleur: 3.0.3
       sisteransi: 1.0.5
 
-  protobufjs@6.11.6:
-    dependencies:
-      '@protobufjs/aspromise': 1.1.2
-      '@protobufjs/base64': 1.1.2
-      '@protobufjs/codegen': 2.0.5
-      '@protobufjs/eventemitter': 1.1.1
-      '@protobufjs/fetch': 1.1.1
-      '@protobufjs/float': 1.0.2
-      '@protobufjs/inquire': 1.1.2
-      '@protobufjs/path': 1.1.2
-      '@protobufjs/pool': 1.1.0
-      '@protobufjs/utf8': 1.1.1
-      '@types/long': 4.0.2
-      '@types/node': 20.19.42
-      long: 4.0.0
-
   protobufjs@7.6.2:
     dependencies:
       '@protobufjs/aspromise': 1.1.2
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index a1a3c074..cb42b7c3 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -7,3 +7,6 @@ allowBuilds:
   msgpackr-extract: true
   protobufjs: true
   sharp: true
+
+overrides:
+  protobufjs: '>=7.5.5'