diff --git a/npm-config-allow.json b/npm-config-allow.json
index 9bd2750..7f775a3 100644
--- a/npm-config-allow.json
+++ b/npm-config-allow.json
@@ -88,6 +88,11 @@
       "value": 1440,
       "why": "The publication cooldown in pnpm-workspace.yaml: no dependency version younger than this many minutes may be resolved. Pinned EXACTLY rather than by a floor, because this allow-set answers `what may a release be configured with` and a release configured with a shorter cooldown than the baseline requires is precisely the configuration nobody approved. drift-manifest.json's installHardening group is where the 1440 is derived; a change has to be a reviewed diff in both."
     },
+    {
+      "key": "minimum-release-age-exclude",
+      "value": ["@cosyte/*"],
+      "why": "The one exemption from the publication cooldown, pinned EXACTLY as a list rather than permitted at any value. The operator decided that @cosyte/* is exempt from the 24-hour floor and that every third-party package keeps it, so the list names our own scope and nothing else. pnpm-workspace.yaml carries the same entry with the `# reason:` comment scripts/install-hardening.mjs refuses to do without, and pnpm reads a scope pattern here from 10.17.0, below the 10.34.5 this repository pins. Adding any other entry, a third-party name above all, must be a reviewed diff here as well as in pnpm-workspace.yaml."
+    },
     {
       "key": "trust-policy",
       "value": "no-downgrade",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index ce8600e..f53ec86 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -24,7 +24,11 @@ packages:
 # package repo. pnpm's own rationale for the number: "Since malware is usually
 # detected quickly, delaying updates by 24 hours will most likely prevent you
 # from installing a bad version" (https://pnpm.io/supply-chain-security).
+# @cosyte is exempt by operator decision; every third-party package keeps the floor.
 minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  # reason: first-party @cosyte package, exempt from the floor by operator decision
+  - "@cosyte/*"
 
 # Fail the install when a package's trust evidence is weaker than that of an
 # earlier-published version of the same package (a trusted publisher that