diff --git a/backend/tests/test_frontend_nanoid_security.py b/backend/tests/test_frontend_nanoid_security.py
new file mode 100644
index 000000000..fe199c092
--- /dev/null
+++ b/backend/tests/test_frontend_nanoid_security.py
@@ -0,0 +1,28 @@
+"""Fail closed when the frontend lock resolves the vulnerable Nano ID release."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+FRONTEND_LOCK = REPO_ROOT / "frontend" / "pnpm-lock.yaml"
+PATCHED_NANOID_VERSION = "3.3.17"
+
+
+def test_frontend_lock_resolves_only_patched_nanoid_3x() -> None:
+    """Require PostCSS's Nano ID dependency to resolve to the reviewed patched 3.x release."""
+    lock = yaml.safe_load(FRONTEND_LOCK.read_text(encoding="utf-8"))
+
+    for section_name in ("packages", "snapshots"):
+        section = lock[section_name]
+        nanoid_3x = sorted(
+            package_key
+            for package_key in section
+            if package_key.startswith("nanoid@3.")
+        )
+        assert nanoid_3x == [f"nanoid@{PATCHED_NANOID_VERSION}"]
+
+    postcss_snapshot = lock["snapshots"]["postcss@8.5.24"]
+    assert postcss_snapshot["dependencies"]["nanoid"] == PATCHED_NANOID_VERSION
diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml
index d7025ff3a..e93e1cb60 100644
--- a/frontend/pnpm-lock.yaml
+++ b/frontend/pnpm-lock.yaml
@@ -2246,8 +2246,8 @@ packages:
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
-  nanoid@3.3.16:
-    resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
+  nanoid@3.3.17:
+    resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -5049,7 +5049,7 @@ snapshots:
 
   ms@2.1.3: {}
 
-  nanoid@3.3.16: {}
+  nanoid@3.3.17: {}
 
   napi-postinstall@0.3.4: {}
 
@@ -5191,7 +5191,7 @@ snapshots:
 
   postcss@8.5.24:
     dependencies:
-      nanoid: 3.3.16
+      nanoid: 3.3.17
       picocolors: 1.1.1
       source-map-js: 1.2.1