diff --git a/apps/frontend/package-lock.json b/apps/frontend/package-lock.json
index 854d7cd0..4545b135 100644
--- a/apps/frontend/package-lock.json
+++ b/apps/frontend/package-lock.json
@@ -15,6 +15,7 @@
         "framer-motion": "^13.4.0",
         "html-to-image": "^1.11.13",
         "lucide-react": "^0.577.0",
+        "partha-monorepo": "file:../..",
         "react": "^18.3.1",
         "react-dom": "^18.3.1",
         "react-dropzone": "^20.1.2",
@@ -4395,9 +4396,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
-      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "version": "7.1.6",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz",
+      "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
@@ -4793,9 +4794,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
diff --git a/apps/frontend/package.json b/apps/frontend/package.json
index e40b18e9..5fba1ae4 100644
--- a/apps/frontend/package.json
+++ b/apps/frontend/package.json
@@ -60,6 +60,8 @@
     "js-yaml": "4.3.2",
     "undici": "7.30.0",
     "nanoid": "3.3.18",
-    "browserslist": "4.28.7"
+    "browserslist": "4.28.7",
+    "postcss-selector-parser": "7.1.6",
+    "source-map-js": "1.2.2"
   }
 }
diff --git a/apps/marketing/package-lock.json b/apps/marketing/package-lock.json
index 375dd52e..e02c779d 100644
--- a/apps/marketing/package-lock.json
+++ b/apps/marketing/package-lock.json
@@ -10,6 +10,7 @@
       "dependencies": {
         "clsx": "^2.1.1",
         "lucide-react": "^0.577.0",
+        "partha-monorepo": "file:../..",
         "react": "^18.3.1",
         "react-dom": "^18.3.1",
         "tailwind-merge": "^2.5.2",
@@ -3398,9 +3399,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
-      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "version": "7.1.6",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz",
+      "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3638,9 +3639,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
diff --git a/apps/marketing/package.json b/apps/marketing/package.json
index 8e86fdc5..88cec156 100644
--- a/apps/marketing/package.json
+++ b/apps/marketing/package.json
@@ -35,5 +35,9 @@
     "typescript": "^5.5.4",
     "typescript-eslint": "^8.67.0",
     "vite": "^8.2.2"
+  },
+  "overrides": {
+    "postcss-selector-parser": "7.1.6",
+    "source-map-js": "1.2.2"
   }
 }
diff --git a/scripts/dependency-audit.mjs b/scripts/dependency-audit.mjs
index 647a1f3b..3466eda0 100644
--- a/scripts/dependency-audit.mjs
+++ b/scripts/dependency-audit.mjs
@@ -45,7 +45,11 @@ function audit(extraArgs) {
   const args = ['audit', '--json', '--prefix', 'apps/frontend', ...extraArgs];
   let stdout;
   try {
-    stdout = execFileSync('npm', args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
+    // npm is a .cmd shim on Windows, which execFileSync cannot launch
+    // directly. All arguments here are fixed internal strings.
+    stdout = process.platform === 'win32'
+      ? execFileSync(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', `npm ${args.join(' ')}`], { cwd: repoRoot, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 })
+      : execFileSync('npm', args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
   } catch (error) {
     // npm audit exits non-zero when it finds anything; the report is still on
     // stdout. A genuinely broken invocation produces no parseable JSON.