diff --git a/.github/workflows/tools/package-lock.json b/.github/workflows/tools/package-lock.json
index 9b265d8d686..a968dd30928 100644
--- a/.github/workflows/tools/package-lock.json
+++ b/.github/workflows/tools/package-lock.json
@@ -985,9 +985,9 @@
       "license": "MIT"
     },
     "node_modules/jose": {
-      "version": "4.15.5",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-4.15.5.tgz",
-      "integrity": "sha512-jc7BFxgKPKi94uOvEmzlSWFFe2+vASyXaKUpdQKatWAESU2MWjDfFf0fdfc83CDKcA5QecabZeNLyfhe3yKNkg==",
+      "version": "4.15.9",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-4.15.9.tgz",
+      "integrity": "sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
diff --git a/.github/workflows/tools/package.json b/.github/workflows/tools/package.json
index d956a00e0b9..760b167f502 100644
--- a/.github/workflows/tools/package.json
+++ b/.github/workflows/tools/package.json
@@ -3,6 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "description": "Pinned CI-only CLI tooling (newman). Not published, not part of the product build. Installed with `npm ci` so package-lock.json's integrity hashes are enforced, which is what OpenSSF Scorecard's Pinned-Dependencies check requires; a bare `npm install -g newman@x` pins the version but verifies nothing.",
+  "overridesRationale": "newman pins vulnerable transitive deps (handlebars, lodash, node-forge, flatted, underscore, qs, jose, uuid). Upstream has not released a newman that picks up the patched versions, so each one is forced to its fixed release here. Every consumer of these packages in the tree was checked for API compatibility, and `newman run` with the cli + htmlextra reporters was exercised against the forced tree. Drop an entry once newman ships a release that resolves at or above it.",
   "dependencies": {
     "newman": "6.2.2",
     "newman-reporter-htmlextra": "1.23.1"
@@ -14,7 +15,7 @@
     "flatted": "3.4.4",
     "underscore": "1.13.8",
     "qs": "6.15.3",
-    "jose": "4.15.5",
+    "jose": "4.15.9",
     "uuid": "11.1.1"
   }
 }