diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 81124e808..18b066b1a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -36,6 +36,7 @@ overrides:
   brace-expansion@>=4.0.0 <5.0.12: ^5.0.12
   undici@>=7.0.0 <7.30.1: ^7.30.1
   vite@>=8.0.0 <8.1.6: ^8.1.6
+  node-forge@<1.4.2: ^1.4.2
 
 patchedDependencies:
   '@stryker-mutator/vitest-runner@10.0.0': 9ad3e9855fd9781fd36e872ed42c5f934f91b962d6830e6cc56d56bf16e1dabd
@@ -5625,8 +5626,8 @@ packages:
       encoding:
         optional: true
 
-  node-forge@1.4.0:
-    resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==}
+  node-forge@1.4.2:
+    resolution: {integrity: sha512-rRtAR5XLJ8gCKd9du4qrKAsgCG1ObGP4gLeNJMa4vYSeq4bmBMOJk5IHkrviBV0q7uoAJlVd8HEQYQSVUb4FGQ==}
     engines: {node: '>= 6.13.0'}
 
   node-releases@2.0.58:
@@ -8711,7 +8712,7 @@ snapshots:
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       jsonwebtoken: 9.0.3
-      node-forge: 1.4.0
+      node-forge: 1.4.2
       verror: 1.10.1
     transitivePeerDependencies:
       - supports-color
@@ -12864,7 +12865,7 @@ snapshots:
     dependencies:
       whatwg-url: 5.0.0
 
-  node-forge@1.4.0: {}
+  node-forge@1.4.2: {}
 
   node-releases@2.0.58: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index fc7937736..f716b3daf 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -109,6 +109,11 @@ overrides:
   # under vitest, never in the image; vitest asks for ^8, so a floor on the
   # same major moves it and nothing else.
   "vite@>=8.0.0 <8.1.6": "^8.1.6"
+  # GHSA-86w9-cpqp-85rv, GHSA-7wch-p9px-956x, GHSA-jc66-7q78-782g,
+  # GHSA-8hrf-8g6f-7xwp, GHSA-hqq3-7jhf-c5jx, GHSA-5x38-2vff-x55p: signature,
+  # certificate-chain and TLS-record flaws in node-forge <= 1.4.0. It arrives
+  # only through @parse/node-apn; 1.4.2 is the release node-apn 8.1.1 pins.
+  "node-forge@<1.4.2": "^1.4.2"
 
 allowBuilds:
   "@prisma/engines": true
@@ -129,15 +134,5 @@ minimumReleaseAgeExclude:
   - lucide-react@1.27.0
   - undici@8.10.0
 
-auditConfig:
-  ignoreGhsas:
-    # node-forge <=1.4.0, RSA PKCS#1 v1.5 signature verification. It arrives
-    # only through @parse/node-apn, which uses it for certificate-based APNs
-    # credentials (p12 / PEM certificate). HealthLog authenticates to APNs
-    # with a token (.p8 key, APNS_KEY_ID / APNS_TEAM_ID), so that code path
-    # never runs. No patched release is published yet (latest is 1.4.0);
-    # remove this entry and raise the floor once 1.4.1 is out.
-    - GHSA-86w9-cpqp-85rv
-
 patchedDependencies:
   "@stryker-mutator/vitest-runner@10.0.0": patches/@stryker-mutator__vitest-runner@10.0.0.patch