diff --git a/web/package.json b/web/package.json
index 0bfde7b..a89b13c 100644
--- a/web/package.json
+++ b/web/package.json
@@ -32,11 +32,5 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.46.2",
     "vite": "^7.2.2"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@swc/core",
-      "esbuild"
-    ]
   }
 }
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
new file mode 100644
index 0000000..686c4ae
--- /dev/null
+++ b/web/pnpm-workspace.yaml
@@ -0,0 +1,9 @@
+# pnpm 10 reads settings from here, not from package.json's `pnpm` field.
+#
+# An explicit allowlist of dependencies permitted to run install scripts. Both
+# fetch a platform-native binary at install time and do not work without it;
+# every other package in the tree is denied, which is the point — an install
+# script is arbitrary code from a transitive dependency.
+onlyBuiltDependencies:
+  - '@swc/core'
+  - esbuild