diff --git a/erc/erc-8350.md b/erc/erc-8350.md
index 3c1ac41..bbba19f 100644
--- a/erc/erc-8350.md
+++ b/erc/erc-8350.md
@@ -544,9 +544,10 @@ property rather than a deployment preference. It is stated normatively under
 because a requirement stated only in this section is read as informative.
 
 Verifiers assessing a deployment SHOULD confirm that no upgrade authority exists
-over the registry — for example that the EIP-1967 implementation and admin slots
-are empty and that the deployed source exposes no owner, admin, initializer, or
-proxy — rather than inferring immutability from vector conformance alone.
+over the registry — for example that the [ERC-1967](./eip-1967.md) implementation
+and admin slots are empty and that the deployed source exposes no owner, admin,
+initializer, or proxy — rather than inferring immutability from vector conformance
+alone.
 
 ## Copyright
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c6720dc..f68cd60 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,6 +6,7 @@ settings:
 
 overrides:
   postcss: '>=8.5.18'
+  nanoid: 3.3.17
 
 importers:
 
@@ -409,8 +410,8 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
-  nanoid@3.3.16:
-    resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
+  nanoid@3.3.17:
+    resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -790,7 +791,7 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  nanoid@3.3.16: {}
+  nanoid@3.3.17: {}
 
   obug@2.1.3: {}
 
@@ -802,7 +803,7 @@ snapshots:
 
   postcss@8.5.25:
     dependencies:
-      nanoid: 3.3.16
+      nanoid: 3.3.17
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 0ebd29a..7bd4fa1 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -8,7 +8,9 @@ allowBuilds:
   esbuild: true
 
 # postcss <=8.5.17: GHSA-r28c-9q8g-f849 (path traversal via sourceMappingURL).
-# Reached only through vite/vitest devDependencies — no runtime surface in this
-# repository — but it fails the audit gate in `pnpm check`, so pin it forward.
+# nanoid <3.3.17: GHSA-2v37-7h3g-55p8 (zero-size custom generator loop).
+# Both are reached only through vite/vitest devDependencies — no runtime surface
+# in this repository — but they fail the audit gate, so pin patched versions.
 overrides:
   postcss: ">=8.5.18"
+  nanoid: "3.3.17"