diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 119f3ed34..5c4f4c910 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -24,7 +24,8 @@ verifyDepsBeforeRun: false
 # fed user-supplied expressions. Kept in sync with the .circleci SECURITY_AUDIT
 # job and the root `audit` script.
 auditConfig:
-  ignoreGhsas: []
+  ignoreGhsas:
+    - GHSA-mp2f-45pm-3cg9 # decompress is called only ever decompresses a hash-pinned, hardcoded archive in a dev-only CLI
 
 allowBuilds:
   '@scarf/scarf': true