diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index ab3e084e51..ca6eb206ce 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -1,6 +1,3 @@
-# pnpm 11+ workspace config. .npmrc is auth/registry only; everything else lives here.
-# Reference: https://pnpm.io/supply-chain-security
-
 packages: []
 
 # Refuse to install on Node/pnpm outside the `engines` block in package.json.
@@ -100,7 +97,7 @@ overrides:
   "fast-uri": "3.1.6"
   # ip-address (via express-rate-limit): SSRF / trust-boundary bypasses from
   # leading-zero octets, CIDR suffixes and IPv4-mapped / NAT64 misclassification.
-  "ip-address": "10.3.1"
+  "ip-address": "10.7.1"
   # mermaid (via streamdown): prototype pollution in config APIs and Architecture
   # diagrams, CSS injection into sibling elements, XY Chart infinite loop and
   # radar diagram DoS.
@@ -157,3 +154,6 @@ trustPolicyExclude:
 
 # Block transitive dependencies from using exotic specifiers (git URLs, tarballs).
 blockExoticSubdeps: true
+minimumReleaseAgeExclude:
+  # Renovate security update: ip-address@10.7.1
+  - ip-address@10.7.1