diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 092fe353f..9938b5d74 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -37,6 +37,7 @@ overrides:
   lodash@<4.18.0: ^4.18.0
   js-cookie@<3.0.7: ^3.0.7
   postcss@<8.5.26: ^8.5.26
+  source-map-js@>=1.0.0 <1.2.2: 1.2.2
   vite@>=7.0.0 <7.3.5: ~7.3.5
   esbuild@>=0.27.3 <0.28.1: ^0.28.1
   brace-expansion@<5.0.12: 5.0.12
@@ -3252,8 +3253,8 @@ packages:
     resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
     engines: {node: '>=8'}
 
-  source-map-js@1.2.1:
-    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
     engines: {node: '>=0.10.0'}
 
   source-map-support@0.5.21:
@@ -5348,7 +5349,7 @@ snapshots:
     dependencies:
       '@babel/parser': 7.29.8
       '@babel/types': 7.29.8
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   make-dir@4.0.0:
     dependencies:
@@ -5596,7 +5597,7 @@ snapshots:
     dependencies:
       nanoid: 3.3.18
       picocolors: 1.1.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   postgres-array@2.0.0: {}
 
@@ -5842,7 +5843,7 @@ snapshots:
 
   slash@3.0.0: {}
 
-  source-map-js@1.2.1: {}
+  source-map-js@1.2.2: {}
 
   source-map-support@0.5.21:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index cdb68f87e..8044a3816 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -86,6 +86,10 @@ overrides:
   # installed with the entry still sitting here looking like a fix. Keep the
   # ceiling AHEAD of the patched floor, not at it.
   'postcss@<8.5.26': '^8.5.26'
+  # #243 GHSA-68fv-2mgg-jv7q / CVE-2026-93749 — source-map-js >=1.0.0 <1.2.2,
+  # patched 1.2.2 (published 2026-09-30). Reached through postcss and magicast,
+  # both of which declare ^1.x, so the pin is in range for every consumer.
+  'source-map-js@>=1.0.0 <1.2.2': '1.2.2'
   # #145 GHSA-fx2h-pf6j-xcff, #146 GHSA-v6wh-96g9-6wx3 — vite dev server (Windows)
   'vite@>=7.0.0 <7.3.5': '~7.3.5'
   # #142 GHSA-g7r4-m6w7-qqqr — esbuild dev server. 0.28.1 is the FIRST patched