diff --git a/.github/workflows/build-publish.yml b/.github/workflows/build-publish.yml
index 6e13b61..1c7cccd 100644
--- a/.github/workflows/build-publish.yml
+++ b/.github/workflows/build-publish.yml
@@ -79,7 +79,7 @@ jobs:
       contents: read
     # The App key is a secret of the `release` environment; environment
     # secrets reach a reusable workflow only through `secrets: inherit`.
-    secrets: inherit # zizmor: ignore[secrets-inherit]
+    secrets: inherit # zizmor: ignore[secrets-inherit] # nosemgrep: yaml.github-actions.security.secrets-inherit.secrets-inherit
     with:
       version-file: package.json
       tag-prefix: ""
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 3c2772e..87917d8 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -2,9 +2,10 @@
 # dependencies (osv-scanner on package-lock.json), semgrep, configuration and
 # licences.
 #
-# Report-only for now (fail-on empty): the report job lists every finding;
-# blocking follows once they are fixed. Accepted findings go into
-# .trivyignore.yaml / security/vex.openvex.json / .gitleaks.toml with a reason.
+# Blocking: a secret, a critical or high vulnerability with a fix, a high
+# misconfiguration, a forbidden licence or a semgrep error fails the check.
+# Accepted findings go into .trivyignore.yaml / security/vex.openvex.json /
+# .gitleaks.toml with a reason and an expiry date.
 name: security
 
 on:
@@ -30,4 +31,4 @@ jobs:
       security-events: write
     with:
       languages: node
-      fail-on: ""
+      fail-on: secrets,vuln-critical,vuln-high,misconfig-high,license-forbidden,semgrep-error
diff --git a/package-lock.json b/package-lock.json
index e8f2557..06af083 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3196,9 +3196,9 @@
             }
         },
         "node_modules/vite": {
-            "version": "7.3.6",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.6.tgz",
-            "integrity": "sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==",
+            "version": "7.3.7",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.7.tgz",
+            "integrity": "sha512-AHEzTORMbi7/7aXp7w7KZ5+DCUdSeLsJz0grY8xHpc9DHdYb0vQu6DqJfm2tOw3gDExNgPgnJTXxM6syYFHaCA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {