diff --git a/package.json b/package.json
index 9bb49fdb29..6b5bb9af72 100644
--- a/package.json
+++ b/package.json
@@ -123,56 +123,5 @@
   },
   "optionalDependencies": {
     "canvas": "catalog:"
-  },
-  "pnpm": {
-    "overrides": {
-      "canvas": "3.2.3",
-      "happy-dom": "20.4.0",
-      "jsdom": "27.3.0",
-      "vue": "3.5.32",
-      "@vue/compiler-core": "3.5.32",
-      "@vue/compiler-dom": "3.5.32",
-      "@vue/compiler-sfc": "3.5.32",
-      "@vue/runtime-core": "3.5.32",
-      "@vue/runtime-dom": "3.5.32",
-      "@vue/server-renderer": "3.5.32",
-      "@vue/shared": "3.5.32",
-      "vite": "npm:rolldown-vite@7.3.1",
-      "axios": "1.18.0",
-      "protobufjs@7": "7.6.4",
-      "protobufjs@8": "8.6.4",
-      "superdoc": "workspace:*",
-      "@superdoc-dev/react": "workspace:*",
-      "@superdoc-dev/superdoc-yjs-collaboration": "workspace:*",
-      "@superdoc-dev/sdk": "workspace:*",
-      "openapi-types": "12.1.3",
-      "@types/minimatch": "5.1.2"
-    },
-    "ignoredBuiltDependencies": [
-      "@parcel/watcher",
-      "@playwright/browser-chromium",
-      "@swc/core",
-      "lmdb",
-      "msgpackr-extract",
-      "msw",
-      "onnxruntime-node",
-      "protobufjs"
-    ],
-    "onlyBuiltDependencies": [
-      "@vscode/vsce-sign",
-      "better-sqlite3",
-      "canvas",
-      "esbuild",
-      "keytar",
-      "lefthook",
-      "puppeteer",
-      "sharp",
-      "unrs-resolver",
-      "vue-demi"
-    ],
-    "patchedDependencies": {
-      "readable-stream@3.6.2": "patches/readable-stream@3.6.2.patch",
-      "openapi-types@12.1.3": "patches/openapi-types@12.1.3.patch"
-    }
   }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 7b29e4dd91..b03080ba9b 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -131,8 +131,35 @@ catalog:
   y-websocket: ^3.0.0
   yjs: ^13.6.19 # range allows consumers to use newer patch versions
 
+# AIDEV-NOTE: This file is the single source for pnpm settings. Do not
+# reintroduce a `pnpm` object in package.json. pnpm 10.6.2+ reads settings
+# from here, and pnpm 11 stops reading package.json#pnpm entirely.
+overrides:
+  canvas: 3.2.3
+  happy-dom: 20.4.0
+  jsdom: 27.3.0
+  vue: 3.5.32
+  '@vue/compiler-core': 3.5.32
+  '@vue/compiler-dom': 3.5.32
+  '@vue/compiler-sfc': 3.5.32
+  '@vue/runtime-core': 3.5.32
+  '@vue/runtime-dom': 3.5.32
+  '@vue/server-renderer': 3.5.32
+  '@vue/shared': 3.5.32
+  vite: 'npm:rolldown-vite@7.3.1'
+  axios: 1.18.0
+  protobufjs@7: 7.6.4
+  protobufjs@8: 8.6.4
+  superdoc: 'workspace:*'
+  '@superdoc-dev/react': 'workspace:*'
+  '@superdoc-dev/superdoc-yjs-collaboration': 'workspace:*'
+  '@superdoc-dev/sdk': 'workspace:*'
+  openapi-types: 12.1.3
+  '@types/minimatch': 5.1.2
+
 onlyBuiltDependencies:
   - '@vscode/vsce-sign'
+  - better-sqlite3
   - canvas
   - esbuild
   - keytar
@@ -142,5 +169,16 @@ onlyBuiltDependencies:
   - unrs-resolver
   - vue-demi
 
+ignoredBuiltDependencies:
+  - '@parcel/watcher'
+  - '@playwright/browser-chromium'
+  - '@swc/core'
+  - lmdb
+  - msgpackr-extract
+  - msw
+  - onnxruntime-node
+  - protobufjs
+
 patchedDependencies:
   readable-stream@3.6.2: patches/readable-stream@3.6.2.patch
+  openapi-types@12.1.3: patches/openapi-types@12.1.3.patch