diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 602adb0..d001ecc 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -33,10 +33,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # The runner's pnpm is not necessarily the workstation's, and this
-      # setting moved location between 10.x releases. Print what it actually
-      # resolves to, so a failure here is diagnosable from the log rather than
-      # by pushing another guess.
+      # The runner's pnpm is not the workstation's -- 11.x here against 10.x
+      # there at the time of writing -- and the build-script allowlist was
+      # renamed between those majors. Printing the version and the resolved
+      # settings is what turned three failed guesses into a one-line answer,
+      # so it stays.
       - name: pnpm environment
         working-directory: web
         run: |
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ecda86c..df4be2b 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -61,10 +61,11 @@ jobs:
 
       # The gate for the frontend, matching the Rust one: a type error or a
       # lint failure must not reach a host either.
-      # The runner's pnpm is not necessarily the workstation's, and this
-      # setting moved location between 10.x releases. Print what it actually
-      # resolves to, so a failure here is diagnosable from the log rather than
-      # by pushing another guess.
+      # The runner's pnpm is not the workstation's -- 11.x here against 10.x
+      # there at the time of writing -- and the build-script allowlist was
+      # renamed between those majors. Printing the version and the resolved
+      # settings is what turned three failed guesses into a one-line answer,
+      # so it stays.
       - name: pnpm environment
         working-directory: web
         run: |
diff --git a/web/package.json b/web/package.json
index 0bfde7b..a89b13c 100644
--- a/web/package.json
+++ b/web/package.json
@@ -32,11 +32,5 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.46.2",
     "vite": "^7.2.2"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@swc/core",
-      "esbuild"
-    ]
   }
 }
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
index d820102..29ba337 100644
--- a/web/pnpm-workspace.yaml
+++ b/web/pnpm-workspace.yaml
@@ -1,12 +1,18 @@
-# The allowlist of dependencies permitted to run install scripts. Both fetch a
-# platform-native binary; every other package in the tree is denied, which is
-# the point -- an install script is arbitrary code from a transitive dependency.
+# Dependencies permitted to run install scripts.
 #
-# Declared here *and* in package.json's `pnpm` field on purpose: pnpm moved
-# this setting between 10.x releases, and the workstation and the CI runner do
-# not carry the same version. Whichever one is authoritative, it finds the same
-# list, and the duplication is four lines against a failure that only shows up
-# on the runner.
+# Both fetch a platform-native binary and do not work without it; every other
+# package in the tree stays denied, which is the point -- an install script is
+# arbitrary code from a transitive dependency.
+#
+# Declared twice because the key was renamed between pnpm majors and the
+# workstation and the CI runner do not carry the same one: pnpm 10 reads
+# `onlyBuiltDependencies` (a list), pnpm 11 reads `allowBuilds` (a map). Each
+# ignores the other's key, so both are listed rather than pinning the fleet to
+# one version. `pnpm approve-builds` writes the pnpm 11 form.
+allowBuilds:
+  '@swc/core': true
+  esbuild: true
+
 onlyBuiltDependencies:
   - '@swc/core'
   - esbuild