diff --git a/CHANGELOG.md b/CHANGELOG.md
index 84bd3e9..801c69a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 ## [Unreleased]
 
+### Security
+
+- Pin `fast-uri` to `^3.1.7` via an npm `overrides` entry. It reaches us transitively as `@modelcontextprotocol/sdk` → `ajv` → `fast-uri`, and the lockfile was resolving `3.1.0`, which is affected by seven high-severity advisories — host confusion via literal backslash ([GHSA-v2hh-gcrm-f6hx](https://github.com/advisories/GHSA-v2hh-gcrm-f6hx)), backslash authority introducer ([GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7)), percent-encoded authority delimiters ([GHSA-v39h-62p7-jpjc](https://github.com/advisories/GHSA-v39h-62p7-jpjc)), percent-encoded scheme normalization ([GHSA-jqff-g426-hqxp](https://github.com/advisories/GHSA-jqff-g426-hqxp)), path traversal via percent-encoded dot segments ([GHSA-q3j6-qgpj-74h6](https://github.com/advisories/GHSA-q3j6-qgpj-74h6)), failed IDN canonicalization ([GHSA-4c8g-83qw-93j6](https://github.com/advisories/GHSA-4c8g-83qw-93j6)), and SSRF via malformed IPv6 normalization ([GHSA-f65p-4m7j-42xc](https://github.com/advisories/GHSA-f65p-4m7j-42xc)). `ajv` validates tool input schemas on the request path, so this dependency is genuinely reachable. Credit to [@Tekscape-finance](https://github.com/Tekscape-finance) for spotting it; note that their `>=3.1.5` floor still leaves three of the seven advisories open, so we pin `^3.1.7`.
+
 ### Added
 
 - **Interactive ticket card via MCP Apps (SEP-1865).** `cw_get_ticket` results now render as an interactive card in MCP Apps hosts (Claude Desktop/web, and other hosts advertising the `io.modelcontextprotocol/ui` extension), instead of a wall of JSON. The card shows status, priority, company, contact, owner, and board as human-readable labels, key dates, and recent notes — and includes a working "Add note" round-trip that calls `cw_add_ticket_note` from inside the card, defaulting to an internal-only (`internalAnalysisFlag`) note resolved server-side. Non-App hosts are unaffected: the tool's JSON payload is unchanged apart from a new `_card` field.
diff --git a/package-lock.json b/package-lock.json
index feb92fd..26c1bd1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3227,9 +3227,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
-      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "funding": [
         {
           "type": "github",
diff --git a/package.json b/package.json
index d122fbd..48e9ebe 100644
--- a/package.json
+++ b/package.json
@@ -70,5 +70,8 @@
   },
   "allowScripts": {
     "esbuild@0.25.12": true
+  },
+  "overrides": {
+    "fast-uri": "^3.1.7"
   }
 }