diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 93b736491..e79c4effb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -228,6 +228,25 @@ only when a separate capability level is intentional, as for Apple Terminal
 charts. Tests that change `chalk.level` must restore it, and environment-driven
 color detection tests must import in a fresh process.
 
+### Dependency pins and overrides
+
+Keep all direct dependencies and devDependencies pinned to exact versions in the
+root and web manifests. The existing `sharp` range is the temporary exception
+while its separate upgrade is in progress. Regenerate the relevant Bun lockfile
+when changing a pin.
+
+The root `overrides` block also controls transitive resolutions:
+
+- `ip-address`: `10.7.4` sets the security floor for the MCP SDK's
+  `express-rate-limit` dependency path.
+- `google-auth-library`: `11.3.1` keeps Google authentication on the same version
+  as the direct dependency. The override accompanies the replacement of the
+  legacy Vertex SDK to remove its deprecated UUID dependency path.
+- `lodash-es`: `4.18.1` keeps transitive copies on the security fixes for template
+  code injection and prototype pollution, avoiding the deprecated `4.18.0` release.
+- `node-domexception`: the existing shim re-exports the platform's native
+  `DOMException` for `fetch-blob`, replacing the deprecated polyfill.
+
 ## AI Agent Guidelines
 
 If you are an AI agent (Copilot, Cursor, Claude, etc.) working on this codebase, refer to [AGENTS.md](AGENTS.md) for project-specific coding guidelines, conventions, and validation commands. Following these guidelines will help your contributions align with the project's patterns and reduce review friction.
diff --git a/bun.lock b/bun.lock
index 834ae4413..31acbae92 100644
--- a/bun.lock
+++ b/bun.lock
@@ -23,7 +23,7 @@
         "@grpc/grpc-js": "1.14.6",
         "@grpc/proto-loader": "0.8.1",
         "@modelcontextprotocol/sdk": "1.32.1",
-        "@sentry/node": "^10.70.0",
+        "@sentry/node": "10.70.0",
         "@smithy/core": "3.36.2",
         "@smithy/node-http-handler": "4.12.1",
         "@types/bun": "1.4.4",
@@ -42,7 +42,7 @@
         "commander": "12.1.0",
         "cross-spawn": "7.0.6",
         "diff": "9.0.0",
-        "duck-duck-scrape": "^2.2.7",
+        "duck-duck-scrape": "2.2.7",
         "emoji-regex": "11.0.0",
         "env-paths": "4.0.0",
         "eslint": "9.39.5",
@@ -106,7 +106,7 @@
   },
   "overrides": {
     "google-auth-library": "11.3.1",
-    "ip-address": "10.2.0",
+    "ip-address": "10.7.4",
     "lodash-es": "4.18.1",
     "node-domexception": "file:vendor/node-domexception-shim",
   },
@@ -895,7 +895,7 @@
 
     "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
 
-    "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="],
+    "ip-address": ["ip-address@10.7.4", "", {}, "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg=="],
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
 
diff --git a/package.json b/package.json
index fa8fb73a2..372adcf31 100644
--- a/package.json
+++ b/package.json
@@ -103,7 +103,7 @@
     "@grpc/grpc-js": "1.14.6",
     "@grpc/proto-loader": "0.8.1",
     "@modelcontextprotocol/sdk": "1.32.1",
-    "@sentry/node": "^10.70.0",
+    "@sentry/node": "10.70.0",
     "@smithy/core": "3.36.2",
     "@smithy/node-http-handler": "4.12.1",
     "@types/bun": "1.4.4",
@@ -122,7 +122,7 @@
     "commander": "12.1.0",
     "cross-spawn": "7.0.6",
     "diff": "9.0.0",
-    "duck-duck-scrape": "^2.2.7",
+    "duck-duck-scrape": "2.2.7",
     "emoji-regex": "11.0.0",
     "env-paths": "4.0.0",
     "eslint": "9.39.5",
@@ -212,7 +212,7 @@
     "access": "public"
   },
   "overrides": {
-    "ip-address": "10.2.0",
+    "ip-address": "10.7.4",
     "google-auth-library": "11.3.1",
     "lodash-es": "4.18.1",
     "node-domexception": "file:vendor/node-domexception-shim"
diff --git a/web/bun.lock b/web/bun.lock
index 817f24d3d..a93cf898e 100644
--- a/web/bun.lock
+++ b/web/bun.lock
@@ -9,7 +9,7 @@
         "@astrojs/sitemap": "3.7.4",
         "@fontsource-variable/geist-mono": "5.3.0",
         "astro": "6.4.8",
-        "typescript": "^6.0.3",
+        "typescript": "6.0.3",
       },
     },
   },
diff --git a/web/package.json b/web/package.json
index 87508b8f0..84d7630f2 100644
--- a/web/package.json
+++ b/web/package.json
@@ -14,6 +14,6 @@
     "@astrojs/sitemap": "3.7.4",
     "@fontsource-variable/geist-mono": "5.3.0",
     "astro": "6.4.8",
-    "typescript": "^6.0.3"
+    "typescript": "6.0.3"
   }
 }