diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 95ae88b..8fe94d1 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -75,11 +75,14 @@ catalog:
 
 autoInstallPeers: false
 
-onlyBuiltDependencies:
-  - '@swc/core'
-  - esbuild
-  - msw
-  - unrs-resolver
+# pnpm 11: allowBuilds (map) replaces onlyBuiltDependencies (list).
+# Build scripts are blocked by default (supply-chain defense). Only allow
+# scripts for packages that genuinely need a postinstall to work.
+allowBuilds:
+  '@swc/core': true
+  esbuild: true
+  msw: true
+  unrs-resolver: true
 
 overrides:
   # replit uses linux-x64 only, we can exclude all other platforms
@@ -174,6 +177,3 @@ overrides:
   linkify-it: ">=5.0.2"
   brace-expansion: ">=5.0.8"
   fast-uri: ">=3.1.4"
-
-allowBuilds:
-  esbuild: set this to true or false