diff --git a/internal/dag/graph.go b/internal/dag/graph.go
index 0d8d637..f1a88d3 100644
--- a/internal/dag/graph.go
+++ b/internal/dag/graph.go
@@ -366,6 +366,7 @@ func FrameworkGraph() *Graph {
 		secResource       = "fireflyframework-security-resource-server"
 		secMethod         = "fireflyframework-security-method-policy"
 		secOauth2         = "fireflyframework-security-oauth2-client"
+		secBff            = "fireflyframework-security-bff"
 		secAuthz          = "fireflyframework-security-authorization-server"
 		secTest           = "fireflyframework-security-test"
 		secAdapterOpa     = "fireflyframework-security-adapter-opa"
@@ -586,6 +587,7 @@ func FrameworkGraph() *Graph {
 	g.AddEdge(secAuthz, secCore)
 	g.AddEdge(secAuthz, secSpi)
 	g.AddEdge(secOauth2, parent) // no internal fireflyframework deps (Spring-only)
+	g.AddEdge(secBff, parent)    // token-handler BFF chain; no internal fireflyframework deps (Spring-only)
 	g.AddEdge(secTest, secApi)
 	g.AddEdge(secTest, secSpi)
 	g.AddEdge(secTest, secWebflux)
diff --git a/internal/setup/cloner.go b/internal/setup/cloner.go
index 695bf11..1965ee1 100644
--- a/internal/setup/cloner.go
+++ b/internal/setup/cloner.go
@@ -62,6 +62,7 @@ var FrameworkRepos = []string{
 	"fireflyframework-security-resource-server",
 	"fireflyframework-security-method-policy",
 	"fireflyframework-security-oauth2-client",
+	"fireflyframework-security-bff",
 	"fireflyframework-security-authorization-server",
 	"fireflyframework-security-test",
 	"fireflyframework-security-adapter-opa",