diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8bb59e..49866cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,8 +54,9 @@ jobs:
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                   node-version-file: .nvmrc
+            - run: npm ci --ignore-scripts
             - name: npm audit
-              run: npm audit --audit-level=moderate
+              run: npx audit-ci --config audit-ci.jsonc
             - name: composer audit
               run: composer audit --locked
 
diff --git a/audit-ci.jsonc b/audit-ci.jsonc
new file mode 100644
index 0000000..3f80af9
--- /dev/null
+++ b/audit-ci.jsonc
@@ -0,0 +1,19 @@
+{
+	"$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+	"moderate": true,
+	"report-type": "important",
+	"allowlist": [
+		// No patched release exists yet (latest published versions are still affected).
+		// Dev/build tooling only; nothing here ships in the plugin zip.
+		"GHSA-vfj7-8cjw-p6xm", // braces (via @wordpress/scripts)
+		"GHSA-hp3w-g68c-fv3c", // sprintf-js (via @wordpress/scripts)
+
+		// simple-git (via @wordpress/env). Fixed only in simple-git 4.x, which drops the
+		// default export wp-env 11.17 relies on. wp-env only clones sources from our own
+		// .wp-env.json. Remove once @wordpress/env supports simple-git >= 4.0.1.
+		"GHSA-v5rq-49vh-5v5c",
+		"GHSA-x6jw-m9v5-85vh",
+		"GHSA-g4wm-2vf7-vfgr",
+		"GHSA-858h-whjf-mvg5"
+	]
+}
diff --git a/package-lock.json b/package-lock.json
index 97bb93c..84f0f79 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,6 +18,7 @@
 				"@wordpress/i18n": "^6.29.0",
 				"@wordpress/prettier-config": "^4.56.0",
 				"@wordpress/scripts": "^36.0.0",
+				"audit-ci": "^7.1.0",
 				"globals": "^17.12.0",
 				"uglify-js": "^3.19.3",
 				"vite": "^8.3.0",
@@ -5633,16 +5634,6 @@
 			"dev": true,
 			"license": "MIT"
 		},
-		"node_modules/@simple-git/argv-parser": {
-			"version": "2.0.1",
-			"resolved": "https://registry.npmjs.org/@simple-git/argv-parser/-/argv-parser-2.0.1.tgz",
-			"integrity": "sha512-M++IaVWrN+vYalilOHfwvT2IL3wYZtVEBQpmX6DLSOJLtxbZ+SUeIDE3IiPogzhPACLajwtxfa5rp+ZX1FczzQ==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"@simple-git/args-pathspec": "^1.0.4"
-			}
-		},
 		"node_modules/@sindresorhus/base62": {
 			"version": "1.0.0",
 			"resolved": "https://registry.npmjs.org/@sindresorhus/base62/-/base62-1.0.0.tgz",
@@ -7509,6 +7500,34 @@
 				"node": ">=18.12.0"
 			}
 		},
+		"node_modules/@wordpress/env/node_modules/@simple-git/argv-parser": {
+			"version": "1.1.1",
+			"resolved": "https://registry.npmjs.org/@simple-git/argv-parser/-/argv-parser-1.1.1.tgz",
+			"integrity": "sha512-Q9lBcfQ+VQCpQqGJFHe5yooOS5hGdLFFbJ5R+R5aDsnkPCahtn1hSkMcORX65J2Z5lxSkD0lQorMsncuBQxYUw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@simple-git/args-pathspec": "^1.0.3"
+			}
+		},
+		"node_modules/@wordpress/env/node_modules/simple-git": {
+			"version": "3.36.0",
+			"resolved": "https://registry.npmjs.org/simple-git/-/simple-git-3.36.0.tgz",
+			"integrity": "sha512-cGQjLjK8bxJw4QuYT7gxHw3/IouVESbhahSsHrX97MzCL1gu2u7oy38W6L2ZIGECEfIBG4BabsWDPjBxJENv9Q==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@kwsites/file-exists": "^1.1.1",
+				"@kwsites/promise-deferred": "^1.1.1",
+				"@simple-git/args-pathspec": "^1.0.3",
+				"@simple-git/argv-parser": "^1.1.0",
+				"debug": "^4.4.0"
+			},
+			"funding": {
+				"type": "github",
+				"url": "https://github.com/steveukx/git-js?sponsor=1"
+			}
+		},
 		"node_modules/@wordpress/escape-html": {
 			"version": "3.57.0",
 			"resolved": "https://registry.npmjs.org/@wordpress/escape-html/-/escape-html-3.57.0.tgz",
@@ -8795,6 +8814,43 @@
 				"when-exit": "^2.1.4"
 			}
 		},
+		"node_modules/audit-ci": {
+			"version": "7.1.0",
+			"resolved": "https://registry.npmjs.org/audit-ci/-/audit-ci-7.1.0.tgz",
+			"integrity": "sha512-PjjEejlST57S/aDbeWLic0glJ8CNl/ekY3kfGFPMrPkmuaYaDKcMH0F9x9yS9Vp6URhuefSCubl/G0Y2r6oP0g==",
+			"dev": true,
+			"license": "Apache-2.0",
+			"dependencies": {
+				"cross-spawn": "^7.0.3",
+				"escape-string-regexp": "^4.0.0",
+				"event-stream": "4.0.1",
+				"jju": "^1.4.0",
+				"jsonstream-next": "^3.0.0",
+				"readline-transform": "1.0.0",
+				"semver": "^7.0.0",
+				"tslib": "^2.0.0",
+				"yargs": "^17.0.0"
+			},
+			"bin": {
+				"audit-ci": "dist/bin.js"
+			},
+			"engines": {
+				"node": ">=16"
+			}
+		},
+		"node_modules/audit-ci/node_modules/semver": {
+			"version": "7.8.5",
+			"resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+			"integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+			"dev": true,
+			"license": "ISC",
+			"bin": {
+				"semver": "bin/semver.js"
+			},
+			"engines": {
+				"node": ">=10"
+			}
+		},
 		"node_modules/autoprefixer": {
 			"version": "10.6.1",
 			"resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.6.1.tgz",
@@ -12191,6 +12247,22 @@
 				"node": ">= 0.6"
 			}
 		},
+		"node_modules/event-stream": {
+			"version": "4.0.1",
+			"resolved": "https://registry.npmjs.org/event-stream/-/event-stream-4.0.1.tgz",
+			"integrity": "sha512-qACXdu/9VHPBzcyhdOWR5/IahhGMf0roTeZJfzz077GwylcDd90yOHLouhmv7GJ5XzPi6ekaQWd8AvPP2nOvpA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"duplexer": "^0.1.1",
+				"from": "^0.1.7",
+				"map-stream": "0.0.7",
+				"pause-stream": "^0.0.11",
+				"split": "^1.0.1",
+				"stream-combiner": "^0.2.2",
+				"through": "^2.3.8"
+			}
+		},
 		"node_modules/event-target-shim": {
 			"version": "5.0.1",
 			"resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
@@ -12676,6 +12748,13 @@
 				"node": ">= 0.6"
 			}
 		},
+		"node_modules/from": {
+			"version": "0.1.7",
+			"resolved": "https://registry.npmjs.org/from/-/from-0.1.7.tgz",
+			"integrity": "sha512-twe20eF1OxVxp/ML/kq2p1uc6KvFK/+vs8WjEbeKmV2He22MKm7YF2ANIt+EOqhJ5L3K/SuuPhk0hWQDjOM23g==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/fs-ext-extra-prebuilt": {
 			"version": "2.2.7",
 			"resolved": "https://registry.npmjs.org/fs-ext-extra-prebuilt/-/fs-ext-extra-prebuilt-2.2.7.tgz",
@@ -14724,6 +14803,13 @@
 				"url": "https://github.com/chalk/supports-color?sponsor=1"
 			}
 		},
+		"node_modules/jju": {
+			"version": "1.4.0",
+			"resolved": "https://registry.npmjs.org/jju/-/jju-1.4.0.tgz",
+			"integrity": "sha512-8wb9Yw966OSxApiCt0K3yNJL8pnNeIv+OEq2YMidz4FKP6nonSRoOXc80iXY4JaN2FC11B9qsNmDsm+ZOfMROA==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/jpeg-js": {
 			"version": "0.4.4",
 			"resolved": "https://registry.npmjs.org/jpeg-js/-/jpeg-js-0.4.4.tgz",
@@ -14857,6 +14943,16 @@
 				"graceful-fs": "^4.1.6"
 			}
 		},
+		"node_modules/jsonparse": {
+			"version": "1.3.1",
+			"resolved": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz",
+			"integrity": "sha512-POQXvpdL69+CluYsillJ7SUhKvytYjW9vG/GKpnf+xP8UWgYEM/RaMzHHofbALDiKbbP1W8UEYmgGl39WkPZsg==",
+			"dev": true,
+			"engines": [
+				"node >= 0.2.0"
+			],
+			"license": "MIT"
+		},
 		"node_modules/jsonpointer": {
 			"version": "5.0.1",
 			"resolved": "https://registry.npmjs.org/jsonpointer/-/jsonpointer-5.0.1.tgz",
@@ -14867,6 +14963,23 @@
 				"node": ">=0.10.0"
 			}
 		},
+		"node_modules/jsonstream-next": {
+			"version": "3.0.0",
+			"resolved": "https://registry.npmjs.org/jsonstream-next/-/jsonstream-next-3.0.0.tgz",
+			"integrity": "sha512-aAi6oPhdt7BKyQn1SrIIGZBt0ukKuOUE1qV6kJ3GgioSOYzsRc8z9Hfr1BVmacA/jLe9nARfmgMGgn68BqIAgg==",
+			"dev": true,
+			"license": "(MIT OR Apache-2.0)",
+			"dependencies": {
+				"jsonparse": "^1.2.0",
+				"through2": "^4.0.2"
+			},
+			"bin": {
+				"jsonstream-next": "bin.js"
+			},
+			"engines": {
+				"node": ">=10"
+			}
+		},
 		"node_modules/jsonwebtoken": {
 			"version": "9.0.3",
 			"resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
@@ -15651,6 +15764,13 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/map-stream": {
+			"version": "0.0.7",
+			"resolved": "https://registry.npmjs.org/map-stream/-/map-stream-0.0.7.tgz",
+			"integrity": "sha512-C0X0KQmGm3N2ftbTGBhSyuydQ+vV1LC3f3zPvT3RXHXNZrvfPZcoXp/N5DOa8vedX/rTMm2CjTtivFg2STJMRQ==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/map-values": {
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/map-values/-/map-values-1.0.1.tgz",
@@ -17875,6 +17995,19 @@
 				"node": ">=8"
 			}
 		},
+		"node_modules/pause-stream": {
+			"version": "0.0.11",
+			"resolved": "https://registry.npmjs.org/pause-stream/-/pause-stream-0.0.11.tgz",
+			"integrity": "sha512-e3FBlXLmN/D1S+zHzanP4E/4Z60oFAa3O051qt1pxa7DEJWKAyil6upYVXCWadEnuoqa4Pkc9oUx9zsxYeRv8A==",
+			"dev": true,
+			"license": [
+				"MIT",
+				"Apache2"
+			],
+			"dependencies": {
+				"through": "~2.3"
+			}
+		},
 		"node_modules/picocolors": {
 			"version": "1.1.1",
 			"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -19259,6 +19392,16 @@
 				"url": "https://paulmillr.com/funding/"
 			}
 		},
+		"node_modules/readline-transform": {
+			"version": "1.0.0",
+			"resolved": "https://registry.npmjs.org/readline-transform/-/readline-transform-1.0.0.tgz",
+			"integrity": "sha512-7KA6+N9IGat52d83dvxnApAWN+MtVb1MiVuMR/cf1O4kYsJG+g/Aav0AHcHKsb6StinayfPLne0+fMX2sOzAKg==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=6"
+			}
+		},
 		"node_modules/rechoir": {
 			"version": "0.8.0",
 			"resolved": "https://registry.npmjs.org/rechoir/-/rechoir-0.8.0.tgz",
@@ -20452,24 +20595,6 @@
 				"simple-concat": "^1.0.0"
 			}
 		},
-		"node_modules/simple-git": {
-			"version": "4.0.2",
-			"resolved": "https://registry.npmjs.org/simple-git/-/simple-git-4.0.2.tgz",
-			"integrity": "sha512-l0sIsv9VrPwovKELFDBOj/lhmIcbMvxBk2B+hRhsMM4/VL3gKtuZvYnBNixVo+N/0HnqQx2cBdLvxnAbygHpqA==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"@kwsites/file-exists": "^1.1.1",
-				"@kwsites/promise-deferred": "^1.1.1",
-				"@simple-git/args-pathspec": "1.0.4",
-				"@simple-git/argv-parser": "2.0.1",
-				"debug": "^4.4.0"
-			},
-			"funding": {
-				"type": "github",
-				"url": "https://github.com/steveukx/git-js?sponsor=1"
-			}
-		},
 		"node_modules/sirv": {
 			"version": "2.0.4",
 			"resolved": "https://registry.npmjs.org/sirv/-/sirv-2.0.4.tgz",
@@ -20737,6 +20862,19 @@
 				"node": ">=8.0"
 			}
 		},
+		"node_modules/split": {
+			"version": "1.0.1",
+			"resolved": "https://registry.npmjs.org/split/-/split-1.0.1.tgz",
+			"integrity": "sha512-mTyOoPbrivtXnwnIxZRFYRrPNtEFKlpB2fvjSnCQUiAA6qAZzqwna5envK4uk6OIeP17CsdF3rSBGYVBsU0Tkg==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"through": "2"
+			},
+			"engines": {
+				"node": "*"
+			}
+		},
 		"node_modules/sprintf-js": {
 			"version": "1.0.3",
 			"resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
@@ -20799,6 +20937,17 @@
 				"node": ">= 0.4"
 			}
 		},
+		"node_modules/stream-combiner": {
+			"version": "0.2.2",
+			"resolved": "https://registry.npmjs.org/stream-combiner/-/stream-combiner-0.2.2.tgz",
+			"integrity": "sha512-6yHMqgLYDzQDcAkL+tjJDC5nSNuNIx0vZtRZeiPh7Saef7VHX9H5Ijn9l2VIol2zaNYlYEX6KyuT/237A58qEQ==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"duplexer": "~0.1.1",
+				"through": "~2.3.4"
+			}
+		},
 		"node_modules/string_decoder": {
 			"version": "1.3.0",
 			"resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -21728,6 +21877,38 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/through": {
+			"version": "2.3.8",
+			"resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz",
+			"integrity": "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/through2": {
+			"version": "4.0.2",
+			"resolved": "https://registry.npmjs.org/through2/-/through2-4.0.2.tgz",
+			"integrity": "sha512-iOqSav00cVxEEICeD7TjLB1sueEL+81Wpzp2bY17uZjZN0pWZPuo4suZ/61VujxmqSGFfgOcNuTZ85QJwNZQpw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"readable-stream": "3"
+			}
+		},
+		"node_modules/through2/node_modules/readable-stream": {
+			"version": "3.6.2",
+			"resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+			"integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"inherits": "^2.0.3",
+				"string_decoder": "^1.1.1",
+				"util-deprecate": "^1.0.1"
+			},
+			"engines": {
+				"node": ">= 6"
+			}
+		},
 		"node_modules/thunky": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/thunky/-/thunky-1.1.0.tgz",
diff --git a/package.json b/package.json
index aa8d0a6..4a55e0f 100644
--- a/package.json
+++ b/package.json
@@ -57,6 +57,7 @@
 		"@wordpress/i18n": "^6.29.0",
 		"@wordpress/prettier-config": "^4.56.0",
 		"@wordpress/scripts": "^36.0.0",
+		"audit-ci": "^7.1.0",
 		"globals": "^17.12.0",
 		"uglify-js": "^3.19.3",
 		"vite": "^8.3.0",
@@ -76,7 +77,7 @@
 		"lint:php": "composer run standards:check",
 		"lint:pkg-json": "wp-scripts lint-pkg-json",
 		"plugin-zip": "wp-scripts plugin-zip",
-		"audit": "npm audit --audit-level=high && composer audit",
+		"audit": "audit-ci --config audit-ci.jsonc && composer audit",
 		"env": "wp-env",
 		"env:start": "wp-env start",
 		"env:stop": "wp-env stop",
@@ -112,7 +113,6 @@
 		"postcss-selector-parser@<7.1.6": "^7.1.6",
 		"qs": "^6.16.0",
 		"serialize-javascript": "^7.1.1",
-		"simple-git": "^4.0.2",
 		"smol-toml": "^1.9.0",
 		"uuid@<11.1.1": "^11.1.1",
 		"ws@>=8.0.0 <8.21.0": "^8.21.3"