diff --git a/CHANGELOG.md b/CHANGELOG.md
index 838a264db..200b9eba9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- The web dashboard and marketing site no longer resolve `fast-uri` 3.1.6,
+  which GHSA-qw65-cvwx-89v3 and GHSA-58mr-gqgx-xq4g (authority injection
+  through an unvalidated port) affect. Both now require 3.1.7 or later; the
+  marketing site had no floor at all.
+
 - The dependency audit accepts far fewer exceptions and re-checks the ones it
   keeps. Three accepted advisories turned out to be ours to fix and are gone:
   `rand` was already on patched versions, `rustls-pemfile` was used by one
diff --git a/web/app/package.json b/web/app/package.json
index 047cd27ac..680d4001f 100644
--- a/web/app/package.json
+++ b/web/app/package.json
@@ -37,7 +37,7 @@
   },
   "pnpm": {
     "overrides": {
-      "fast-uri": "^3.1.6",
+      "fast-uri": "^3.1.7",
       "nanoid": "^3.3.17",
       "js-yaml": "^4.3.2",
       "svgo": "^4.1.0",
diff --git a/web/app/pnpm-lock.yaml b/web/app/pnpm-lock.yaml
index 13178d1fe..5c615aed2 100644
--- a/web/app/pnpm-lock.yaml
+++ b/web/app/pnpm-lock.yaml
@@ -5,7 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  fast-uri: ^3.1.6
+  fast-uri: ^3.1.7
   nanoid: ^3.3.17
   js-yaml: ^4.3.2
   svgo: ^4.1.0
diff --git a/web/marketing/package.json b/web/marketing/package.json
index 82e38aeb9..0ab243618 100644
--- a/web/marketing/package.json
+++ b/web/marketing/package.json
@@ -22,6 +22,7 @@
   },
   "pnpm": {
     "overrides": {
+      "fast-uri": "^3.1.7",
       "nanoid": "^3.3.17",
       "js-yaml": "^4.3.2",
       "svgo": "^4.1.0",
diff --git a/web/marketing/pnpm-lock.yaml b/web/marketing/pnpm-lock.yaml
index 8838c9dd6..57634cc0b 100644
--- a/web/marketing/pnpm-lock.yaml
+++ b/web/marketing/pnpm-lock.yaml
@@ -5,6 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  fast-uri: ^3.1.7
   nanoid: ^3.3.17
   js-yaml: ^4.3.2
   svgo: ^4.1.0
@@ -1146,8 +1147,8 @@ packages:
   fast-string-width@3.0.2:
     resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
 
-  fast-uri@3.1.6:
-    resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==}
+  fast-uri@3.1.8:
+    resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
 
   fast-wrap-ansi@0.2.2:
     resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -2762,7 +2763,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.6
+      fast-uri: 3.1.8
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -3049,7 +3050,7 @@ snapshots:
     dependencies:
       fast-string-truncated-width: 3.0.3
 
-  fast-uri@3.1.6: {}
+  fast-uri@3.1.8: {}
 
   fast-wrap-ansi@0.2.2:
     dependencies: