diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 464e27b..8f92780 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,7 +12,7 @@ overrides:
   picomatch: '>=4.0.4'
   yaml: '>=2.8.3'
   postcss: '>=8.5.18'
-  brace-expansion@2: '>=2.1.3 <3'
+  brace-expansion@2: '>=2.1.3 <6'
   brace-expansion@5: '>=5.0.8'
   js-yaml: '>=4.3.0 <5'
   sharp: '>=0.35.0'
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 218f215..23229dd 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -15,7 +15,8 @@ minimumReleaseAge: 1440
 # fix. Version-scoped so future releases of the package still age-gate.
 # Safe to delete from 2026-07-30 (2.1.3 clears the window 2026-07-29 ~10:17 UTC).
 minimumReleaseAgeExclude:
-  - 'brace-expansion@2.1.3'
+  # Renovate security update: brace-expansion@5.0.8
+  - 'brace-expansion@2.1.3 || 5.0.8'
 
 # GHSA-mh99-v99m-4gvg's advisory data claims vulnerable <=5.0.7 / patched
 # 5.0.8 only — a range that swallows the whole 2.x line and does not yet
@@ -61,7 +62,7 @@ overrides:
   picomatch: '>=4.0.4'
   yaml: '>=2.8.3'
   postcss: '>=8.5.18' # GHSA-r28c-9q8g-f849
-  'brace-expansion@2': '>=2.1.3 <3' # GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg 2.x backport
+  'brace-expansion@2': '>=2.1.3 <6' # GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg 2.x backport
   'brace-expansion@5': '>=5.0.8' # GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg
   js-yaml: '>=4.3.0 <5' # GHSA-52cp-r559-cp3m
   sharp: '>=0.35.0' # GHSA-f88m-g3jw-g9cj (build denied above; pin is belt+braces)