diff --git a/package.json b/package.json
index 35cfef99..781f77d5 100644
--- a/package.json
+++ b/package.json
@@ -61,6 +61,7 @@
   "pnpm": {
     "overrides": {
       "@types/uuid": "^9.0.8",
+      "fast-uri": "^3.1.2",
       "hono": "^4.11.7",
       "uuid": "^10.0.0",
       "zod": "^4.1.12"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5ade2a9d..b5f69c3a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -126,6 +126,7 @@ catalogs:
 
 overrides:
   '@types/uuid': ^9.0.8
+  fast-uri: ^3.1.2
   hono: ^4.11.7
   uuid: ^10.0.0
   zod: ^4.1.12
@@ -2396,8 +2397,8 @@ packages:
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-uri@3.1.0:
-    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+  fast-uri@3.1.3:
+    resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==}
 
   fb-watchman@2.0.2:
     resolution: {integrity: sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==}
@@ -5111,7 +5112,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
+      fast-uri: 3.1.3
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -5575,7 +5576,7 @@ snapshots:
 
   fast-levenshtein@2.0.6: {}
 
-  fast-uri@3.1.0: {}
+  fast-uri@3.1.3: {}
 
   fb-watchman@2.0.2:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 8d145adc..96179d0f 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -81,6 +81,14 @@ overrides:
   # Zod
   "zod": "^4.1.12"
 
+  # fast-uri - security remediation. Forces a patched release that fixes two URI
+  # normalization issues: percent-encoded authority-delimiter decoding (fixed in
+  # 3.1.2) and percent-encoded path-separator / dot-segment decoding (fixed in
+  # 3.1.1). Pinned within the 3.x line to satisfy ajv@8's "fast-uri: ^3.0.1"
+  # requirement. Remove once the transitive parents (ajv /
+  # @modelcontextprotocol/sdk) resolve a patched fast-uri by default.
+  "fast-uri": "^3.1.2"
+
   # Development dependencies - align versions
   "@types/uuid": "^9.0.0"
   "uuid": "^10.0.0"