diff --git a/package.json b/package.json
index 98a460f..824557a 100644
--- a/package.json
+++ b/package.json
@@ -7,9 +7,9 @@
   "license": "MIT",
   "engines": {
     "node": ">=22.0.0",
-    "pnpm": ">=11.8.0"
+    "pnpm": ">=11.11.0"
   },
-  "packageManager": "pnpm@11.8.0",
+  "packageManager": "pnpm@11.11.0",
   "scripts": {
     "build": "turbo run build",
     "test": "turbo run test",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index de75fa4..ca8e08b 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -16,6 +16,8 @@ minimumReleaseAge: 1440
 # Safe to delete from 2026-07-30 (2.1.3 clears the window 2026-07-29 ~10:17 UTC).
 minimumReleaseAgeExclude:
   - 'brace-expansion@2.1.3'
+  # Renovate security update: pnpm@11.11.0
+  - pnpm@11.11.0
 
 # GHSA-mh99-v99m-4gvg's advisory data claims vulnerable <=5.0.7 / patched
 # 5.0.8 only — a range that swallows the whole 2.x line and does not yet