diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9cc6db2..5cfa273 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.27.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f808a9..179b738 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,10 @@ No unreleased changes.
 
 ### Release and verification
 
+- Pinned the transitive build-time `nanoid` 3.x line to `3.3.18`, the first
+  patched release for CVE-2026-67213 / GHSA-2v37-7h3g-55p8. The affected path
+  is confined to Vite/PostCSS development tooling and is not a runtime
+  dependency of any published `@bidilens/*` package.
 - Pinned the supported CI runtimes to exact Node 22.12.0 and 24.15.0 releases
   so the documented minimum is exercised instead of silently floating to the
   newest release in each major line.
diff --git a/package.json b/package.json
index a485e92..5928180 100644
--- a/package.json
+++ b/package.json
@@ -88,7 +88,7 @@
       "fast-uri": "3.1.5",
       "js-yaml@3": "3.15.1",
       "js-yaml@4": "4.3.1",
-      "nanoid": "3.3.17",
+      "nanoid": "3.3.18",
       "postcss": "8.5.23",
       "undici": "7.29.0"
     }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e137836..2f0590c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -10,7 +10,7 @@ overrides:
   fast-uri: 3.1.5
   js-yaml@3: 3.15.1
   js-yaml@4: 4.3.1
-  nanoid: 3.3.17
+  nanoid: 3.3.18
   postcss: 8.5.23
   undici: 7.29.0
 
@@ -2087,8 +2087,8 @@ packages:
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
 
-  nanoid@3.3.17:
-    resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -4697,7 +4697,7 @@ snapshots:
       object-assign: 4.1.1
       thenify-all: 1.6.0
 
-  nanoid@3.3.17: {}
+  nanoid@3.3.18: {}
 
   natural-compare@1.4.0: {}
 
@@ -4814,7 +4814,7 @@ snapshots:
 
   postcss@8.5.23:
     dependencies:
-      nanoid: 3.3.17
+      nanoid: 3.3.18
       picocolors: 1.1.1
       source-map-js: 1.2.1