diff --git a/scripts/audit-allowlist.json b/scripts/audit-allowlist.json
new file mode 100644
index 0000000..5da1b35
--- /dev/null
+++ b/scripts/audit-allowlist.json
@@ -0,0 +1,7 @@
+{
+  "GHSA-gv7w-rqvm-qjhr": {
+    "reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
+    "reviewer": "luc",
+    "expires": "2026-09-01"
+  }
+}
diff --git a/scripts/outdated-pins.json b/scripts/outdated-pins.json
new file mode 100644
index 0000000..be43c71
--- /dev/null
+++ b/scripts/outdated-pins.json
@@ -0,0 +1,6 @@
+{
+  "eslint": "ESLint 10 breaks eslint-plugin-react@7.37.5 (jsx-eslint#3977). Unpin when plugin releases ESLint 10 support.",
+  "@eslint/js": "Pinned with eslint — same constraint.",
+  "zod": "zod v4 has breaking API changes. Pin at 3.x until migration is planned.",
+  "@types/node": "Pinned to Node 22 LTS types to match runtime; Node 25 is not LTS."
+}