diff --git a/build.gradle.kts b/build.gradle.kts
index f1eee3c5..d8d60e34 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -7,4 +7,11 @@ plugins {
     alias(libs.plugins.composeCompiler) apply false
     alias(libs.plugins.kotlinJvm) apply false
     alias(libs.plugins.kotlinMultiplatform) apply false
-}
\ No newline at end of file
+}
+// Ktor's JS/wasm client pins ws 8.20.1 (still on Ktor main), which is in the range of a ws security
+// advisory; Dependabot can't bump it because kotlin-js-store/wasm has a lockfile but no package.json.
+// The browser app never loads ws (it uses the browser's own WebSocket), but override it to a fixed
+// release so the lock stops carrying the vulnerable version. Drop this once Ktor bumps ws itself.
+plugins.withType<org.jetbrains.kotlin.gradle.targets.wasm.yarn.WasmYarnPlugin> {
+    the<org.jetbrains.kotlin.gradle.targets.wasm.yarn.WasmYarnRootExtension>().resolution("ws", "8.22.0")
+}
diff --git a/kotlin-js-store/wasm/yarn.lock b/kotlin-js-store/wasm/yarn.lock
index 5b1d40ea..32bd893a 100644
--- a/kotlin-js-store/wasm/yarn.lock
+++ b/kotlin-js-store/wasm/yarn.lock
@@ -12,7 +12,7 @@
   resolved "https://registry.yarnpkg.com/@js-joda/timezone/-/timezone-2.25.2.tgz#09b7862b47d63fd68661548344ab1d1eca350669"
   integrity sha512-TEjy13bQrJyIkoWZ4EqiZ+Vz66y3sYhEdibySZpfLgPij6mhh8ncGb0NGkSROOg2PwSmZLu1+0f3o4esSv2Yaw==
 
-ws@8.20.1:
-  version "8.20.1"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.20.1.tgz#91a9ae2b312ccf98e0a85ec499b48cef45ab0ddb"
-  integrity sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==
+ws@8.20.1, ws@8.22.0:
+  version "8.22.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.22.0.tgz#40f16e1d7588ac0575041be5c49b8eb261c28e73"
+  integrity sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==