diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 53610029d..dbe7c3e86 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,6 +12,7 @@ overrides:
   picomatch@<4.0.4: ^4.0.4
   body-parser@<2.3.0: ^2.3.0
   fast-uri@<3.1.5: ^3.1.5
+  ip-address@<10.3.1: ^10.3.1
   sharp@<0.35.0: ^0.35.3
 
 importers:
@@ -4950,10 +4951,6 @@ packages:
   iobuffer@5.4.0:
     resolution: {integrity: sha512-DRebOWuqDvxunfkNJAlc3IzWIPD5xVxwUNbHr7xKB8E6aLJxIPfNX3CoMJghcFjpv6RWQsrcJbghtEwSPoJqMA==}
 
-  ip-address@10.2.0:
-    resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==}
-    engines: {node: '>= 12'}
-
   ip-address@10.4.0:
     resolution: {integrity: sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==}
     engines: {node: '>= 12'}
@@ -11712,7 +11709,7 @@ snapshots:
   express-rate-limit@8.5.2(express@5.2.1(supports-color@7.2.0)):
     dependencies:
       express: 5.2.1(supports-color@7.2.0)
-      ip-address: 10.2.0
+      ip-address: 10.4.0
 
   express-rate-limit@8.6.1(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0):
     dependencies:
@@ -12152,8 +12149,6 @@ snapshots:
 
   iobuffer@5.4.0: {}
 
-  ip-address@10.2.0: {}
-
   ip-address@10.4.0: {}
 
   ipaddr.js@1.9.1: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 787fdd102..15a8dafd2 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -6,6 +6,11 @@ overrides:
   "picomatch@<4.0.4": "^4.0.4"
   "body-parser@<2.3.0": "^2.3.0"
   "fast-uri@<3.1.5": "^3.1.5"
+  # Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
+  # 10.0.0.1 rather than being rejected. That is the exact alt-notation class
+  # `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
+  # rate limiter where nothing of ours screens it.
+  "ip-address@<10.3.1": "^10.3.1"
   "sharp@<0.35.0": "^0.35.3"
 
 allowBuilds: