diff --git a/.circleci/config.yml b/.circleci/config.yml
index 6b9df3b8d..25833015f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -119,8 +119,20 @@ jobs:
             echo "🔍 Running bun audit for security vulnerabilities..."
             echo "Checking for HIGH-RISK vulnerabilities..."
 
-            # Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line
-            if bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level high; then
+            # Define ignored vulnerabilities with comments
+            IGNORED_VULNS=(
+              "GHSA-5j98-mcp5-4vw2"  # CVE-2025-64756 - glob is not used on the command line
+              "GHSA-8qq5-rm4j-mr97"  # CVE-2026-23745 - limited to build/dev environments
+              "GHSA-r6q2-hw4h-h46w"  # CVE-2026-23950 - limited to build/dev environments
+            )
+
+            # Build ignore flags
+            IGNORE_FLAGS=""
+            for vuln in "${IGNORED_VULNS[@]}"; do
+              IGNORE_FLAGS="$IGNORE_FLAGS --ignore=$vuln"
+            done
+
+            if bun audit $IGNORE_FLAGS --audit-level high; then
               echo "✅ No high-risk vulnerabilities found"
               echo "🎉 Security audit passed!"
             else
@@ -137,8 +149,7 @@ jobs:
               echo ""
               echo "📋 Full audit report:"
 
-              # Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line
-              bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level low || true
+              bun audit $IGNORE_FLAGS --audit-level low || true
 
               echo ""
               echo "❌ This build cannot proceed until high-risk vulnerabilities are resolved."