diff --git a/ui/package.json b/ui/package.json
index 05bef52188..e897cdcb7f 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -153,7 +153,7 @@
     "jsdom": "27.4.0",
     "knip": "6.3.1",
     "msw": "2.13.4",
-    "postcss": "8.5.14",
+    "postcss": "8.5.18",
     "prettier": "3.6.2",
     "prettier-plugin-packagejson": "2.5.22",
     "prettier-plugin-tailwindcss": "0.6.14",
diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index cd3f7d25f2..eeb2e3b432 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -1,6 +1,3 @@
-# pnpm 11+ workspace config. .npmrc is auth/registry only; everything else lives here.
-# Reference: https://pnpm.io/supply-chain-security
-
 packages: []
 
 # Refuse to install on Node/pnpm outside the `engines` block in package.json.
@@ -32,7 +29,7 @@ overrides:
   "@isaacs/brace-expansion": "5.0.1"
   "fast-xml-parser": "5.8.0"
   "serialize-javascript": "7.0.5"
-  "postcss": "8.5.14"
+  "postcss": "8.5.18"
   "esbuild": "0.28.1"
   "rollup@>=4": "4.59.0"
   # GHSA-fx2h-pf6j-xcff (server.fs.deny bypass on Windows alternate paths, high) +
@@ -121,3 +118,6 @@ trustPolicyExclude:
 
 # Block transitive dependencies from using exotic specifiers (git URLs, tarballs).
 blockExoticSubdeps: true
+minimumReleaseAgeExclude:
+  # Renovate security update: postcss@8.5.18
+  - postcss@8.5.18