diff --git a/protocol/package.json b/protocol/package.json
index d75069b6f..6f995329c 100644
--- a/protocol/package.json
+++ b/protocol/package.json
@@ -8,6 +8,12 @@
   "engines": {
     "node": ">=22.14.0"
   },
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@1": "1.1.16",
+      "nanoid@3": "3.3.18"
+    }
+  },
   "scripts": {
     "check-tools": "./scripts/check_codegen_tools.sh",
     "codegen:kotlin": "./scripts/generate_models.sh --lang kotlin",
diff --git a/protocol/pnpm-lock.yaml b/protocol/pnpm-lock.yaml
index e3a651dad..1ddcc91cd 100644
--- a/protocol/pnpm-lock.yaml
+++ b/protocol/pnpm-lock.yaml
@@ -4,6 +4,10 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  brace-expansion@1: 1.1.16
+  nanoid@3: 3.3.18
+
 importers:
 
   .:
@@ -440,8 +444,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  brace-expansion@1.1.14:
-    resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==}
+  brace-expansion@1.1.16:
+    resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==}
 
   brace-expansion@5.0.7:
     resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==}
@@ -1688,7 +1692,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  brace-expansion@1.1.14:
+  brace-expansion@1.1.16:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
@@ -2051,7 +2055,7 @@ snapshots:
 
   minimatch@3.1.5:
     dependencies:
-      brace-expansion: 1.1.14
+      brace-expansion: 1.1.16
 
   moment@2.30.1: {}