diff --git a/changelog.d/fixed-448-undici-override.md b/changelog.d/fixed-448-undici-override.md
new file mode 100644
index 0000000..5a8f57b
--- /dev/null
+++ b/changelog.d/fixed-448-undici-override.md
@@ -0,0 +1 @@
+- Bump transitive undici to 8.12.3 (via jsdom, dev-only) to clear GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472 and GHSA-xjj6-f33q-929c from `npm audit`.
diff --git a/package-lock.json b/package-lock.json
index 4653af7..1188495 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15028,9 +15028,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.11.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
-      "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
+      "version": "8.12.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz",
+      "integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/package.json b/package.json
index 751f1ee..3e5a447 100644
--- a/package.json
+++ b/package.json
@@ -76,6 +76,7 @@
     "follow-redirects": ">=1.16.0",
     "js-yaml": ">=5.2.2",
     "markdown-it": ">=15.0.3",
+    "undici": ">=8.12.2",
     "nanoid": ">=3.3.17",
     "postcss": ">=8.5.18",
     "sharp": ">=0.35.3",