diff --git a/.archgate/adrs/GEN-005-repository-root-contents-allowlist.rules.ts b/.archgate/adrs/GEN-005-repository-root-contents-allowlist.rules.ts
index 52445286..15b622ad 100644
--- a/.archgate/adrs/GEN-005-repository-root-contents-allowlist.rules.ts
+++ b/.archgate/adrs/GEN-005-repository-root-contents-allowlist.rules.ts
@@ -21,6 +21,7 @@ const ALLOWED_ROOT_FILES = new Set([
   ".simple-release.js",
   "renovate.json",
   "zizmor.yml",
+  "osv-scanner.toml",
 
   // Governance / community-health documents
   "README.md",
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index bedbb000..b388c583 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Run OpenSSF Scorecard
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 00000000..c5bc14a3
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,10 @@
+# OSV ignore list, read by OSV-Scanner and the Scorecard Vulnerabilities check.
+
+[[IgnoredVulns]]
+id = "GHSA-vfj7-8cjw-p6xm"
+ignoreUntil = 2027-01-31
+reason = """
+braces <=3.0.3 stack exhaustion on deeply nested patterns; no patched release exists. \
+Reached only via the dev-only release tool @simple-release/npm -> fast-glob -> micromatch, \
+which expands repository-authored glob patterns and never untrusted input. Not shipped in the CLI.\
+"""