diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index 3db3cc19e3..f1ee0f8b35 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -1,6 +1,3 @@
-# pnpm 11+ workspace config. .npmrc is auth/registry only; everything else lives here.
-# Reference: https://pnpm.io/supply-chain-security
-
 packages: []
 
 # Refuse to install on Node/pnpm outside the `engines` block in package.json.
@@ -23,7 +20,7 @@ overrides:
   "@react-aria/interactions>react": "19.2.7"
   "lodash": "4.18.1"
   "lodash-es": "4.18.1"
-  "hono": "4.12.21"
+  "hono": "4.12.25"
   "@hono/node-server": "1.19.14"
   "@isaacs/brace-expansion": "5.0.1"
   "fast-xml-parser": "5.8.0"
@@ -93,3 +90,6 @@ trustPolicyExclude:
 
 # Block transitive dependencies from using exotic specifiers (git URLs, tarballs).
 blockExoticSubdeps: true
+minimumReleaseAgeExclude:
+  # Renovate security update: hono@4.12.25
+  - hono@4.12.25