diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 07aa9b7..a00e0ea 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -24,7 +24,6 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # sadr: cooldown exception CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497, lift when 24.22.1 clears the cooldown
           node-version: 24.22.1
 
       # koreader/test-data holds leaves.epub and tall.pdf, whose partial-MD5
@@ -60,7 +59,6 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # sadr: cooldown exception CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497, lift when 24.22.1 clears the cooldown
           node-version: 24.22.1
 
       - name: Wait for the reference server
@@ -139,7 +137,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          # sadr: cooldown exception CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497, lift when 24.22.1 clears the cooldown
           node-version: 24.22.1
       - run: node --check verify.mjs
       - run: node --check vectors/check.mjs
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index e7f15c8..0a0e26e 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -20,7 +20,7 @@ jobs:
     env:
       SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
     container:
-      image: semgrep/semgrep:1.181.0@sha256:81474464c1f07483ba0682a44787fd93c91397419762a04abe2bafaae396304b
+      image: semgrep/semgrep:1.182.0@sha256:4a34048c04fef049f71665047f074cffb00cc3d89482f965a5cd151d589237af
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - run: semgrep ci