diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 2f95c35f1..aade691c4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -73,8 +73,10 @@ overrides:
   # transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
   # the store into the standalone image — so an unused transitive copy is still
   # a copy in the runtime image. The range is bounded on both ends deliberately:
-  # `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
-  # text-extraction path, so it must not be dragged onto a new major.
+  # `pdf-parse` resolves 5.4.296, which predates the flaw. Only the tests use it
+  # now (they read generated PDFs back); it must not be dragged onto a new
+  # major, because its teardown calls `PDFDocumentProxy.destroy()`, which pdfjs
+  # 6 no longer has. Local text extraction reads with the app's own pdfjs.
   "pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
   # Deeply nested input drives DeepmergeTS into unbounded recursion until the
   # stack gives out. The copy here is Prisma's: `@prisma/config` still asks for