diff --git a/docs-website/README.md b/docs-website/README.md
index fde9dbaf0..099c1ea92 100644
--- a/docs-website/README.md
+++ b/docs-website/README.md
@@ -58,6 +58,29 @@ without a code change:
 A fork which deploys to `https://<user>.github.io/OpenMU/` would therefore build
 with `DOCS_URL=https://<user>.github.io DOCS_BASE_URL=/OpenMU/`.
 
+## Dependency overrides
+
+`package.json` contains an `overrides` block which forces two transitive
+dependencies to a patched version:
+
+| Package | Why |
+|---|---|
+| `serialize-javascript` | `copy-webpack-plugin` and `css-minimizer-webpack-plugin` pin `^6.0.0`, which is affected by [GHSA-5c6j-r48x-rmvq](https://github.com/advisories/GHSA-5c6j-r48x-rmvq) and [GHSA-qj8w-gfj5-8c6v](https://github.com/advisories/GHSA-qj8w-gfj5-8c6v). 7.1.0 is the fixed line. |
+| `uuid` | `sockjs` (via `webpack-dev-server`) pins `^8.3.2`, which is affected by [GHSA-w5hq-g745-h8pq](https://github.com/advisories/GHSA-w5hq-g745-h8pq). |
+
+Remove an entry once the parent package ships a release which depends on the
+fixed version by itself — `npm ls <package>` no longer printing "overridden"
+next to it is the signal that the override became redundant.
+
+One advisory has no fix and is therefore not overridden: `image-size`, used by
+`@docusaurus/mdx-loader` to measure the images of a page, is affected by
+[GHSA-w3rx-r6r6-pgpr](https://github.com/advisories/GHSA-w3rx-r6r6-pgpr) and
+[GHSA-5p2g-fcmc-qvqq](https://github.com/advisories/GHSA-5p2g-fcmc-qvqq) in
+every published version. Both are denial of service through a crafted ICNS, JXL
+or HEIF file. It runs at build time over the images committed to this
+repository, so triggering it means committing a malicious image, and the damage
+is a hanging build — no published page and no game server is exposed to it.
+
 ## CI
 
 [`.github/workflows/docs-website.yml`](../.github/workflows/docs-website.yml)
diff --git a/docs-website/package-lock.json b/docs-website/package-lock.json
index d37fd884f..eb3f5416a 100644
--- a/docs-website/package-lock.json
+++ b/docs-website/package-lock.json
@@ -16838,15 +16838,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/randombytes": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
-      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "^5.1.0"
-      }
-    },
     "node_modules/range-parser": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.0.tgz",
@@ -17832,12 +17823,12 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
-      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.0.tgz",
+      "integrity": "sha512-RNEqWOyhhUQYN9V1GfHwu9AR/g+NTciH6Z5u3/no6X3/w+04J2lVDL+svFQVXgXrEGBMG2puMVN3gq2SNGuTGw==",
       "license": "BSD-3-Clause",
-      "dependencies": {
-        "randombytes": "^2.1.0"
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/serve-handler": {
@@ -19309,13 +19300,16 @@
       }
     },
     "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist/esm/bin/uuid"
       }
     },
     "node_modules/value-equal": {
diff --git a/docs-website/package.json b/docs-website/package.json
index b7486d64c..fa32f3410 100644
--- a/docs-website/package.json
+++ b/docs-website/package.json
@@ -42,5 +42,9 @@
   },
   "engines": {
     "node": ">=20.0"
+  },
+  "overrides": {
+    "serialize-javascript": "^7.1.0",
+    "uuid": "^11.1.1"
   }
 }