diff --git a/ci/npm-audit-exceptions.json b/ci/npm-audit-exceptions.json
index f226765ed30..7b5fb4c2ad8 100644
--- a/ci/npm-audit-exceptions.json
+++ b/ci/npm-audit-exceptions.json
@@ -1,4 +1,21 @@
 {
   "schemaVersion": 1,
-  "exceptions": []
+  "exceptions": [
+    {
+      "advisory": "GHSA-2883-xcg3-v3hh",
+      "compensatingControls": [
+        "The identified production consumer reads agent manifests from the installed repository, not a remote request endpoint.",
+        "Keep agent manifest files under maintainer control during the exception period."
+      ],
+      "decision": "temporary-risk-acceptance",
+      "expires": "2026-09-10",
+      "graph": "nemoclaw-cli",
+      "installedVersion": "4.3.1",
+      "owner": "Rebecca Sliter",
+      "package": "js-yaml",
+      "rationale": "Rebecca Sliter approved deferring the js-yaml 4.3.2 upgrade from v0.0.121 until September 10, 2026. This accepts the identified merge-work denial-of-service risk temporarily; it does not establish that all callers are unaffected.",
+      "severity": "high",
+      "trackingIssue": "https://github.com/NVIDIA/NemoClaw/issues/11252"
+    }
+  ]
 }
diff --git a/test/automation/releases/reviewed-npm-audit.test.ts b/test/automation/releases/reviewed-npm-audit.test.ts
index fbbd3eacf40..c889e3afccd 100644
--- a/test/automation/releases/reviewed-npm-audit.test.ts
+++ b/test/automation/releases/reviewed-npm-audit.test.ts
@@ -129,7 +129,9 @@ function exceptionPolicy(
 
 describe("reviewed npm audit gate", () => {
   it("removes the checked-in brace-expansion exception after remediation (#8116)", () => {
-    expect(CHECKED_IN_POLICY).toEqual(EMPTY_POLICY);
+    expect(CHECKED_IN_POLICY.exceptions).not.toEqual(
+      expect.arrayContaining([expect.objectContaining({ package: "brace-expansion" })]),
+    );
   });
 
   it("fails at high or critical findings while retaining lower severities", () => {