diff --git a/apps/api/audit-ci.jsonc b/apps/api/audit-ci.jsonc
index 0177814c8..f84e0812b 100644
--- a/apps/api/audit-ci.jsonc
+++ b/apps/api/audit-ci.jsonc
@@ -2,9 +2,9 @@
     "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
     "low": true,
     "allowlist": [
-        "GHSA-3gc7-fjrx-p6mg|x402-express>@coinbase/cdp-sdk>@solana/spl-token>@solana/buffer-layout-utils>bigint-buffer", // never gets called in our code paths
         "GHSA-33vc-wfww-vjfv|ai>jsondiffpatch", // we don't care about the HTML coming out of jsondiffpatch
-        "GHSA-qj3p-xc97-xw74|x402-express>x402>wagmi>@wagmi/connectors>@metamask/sdk", // we don't use the Metamask SDK in the browser
-        "GHSA-qj3p-xc97-xw74|x402-express>x402>wagmi>@wagmi/connectors>@metamask/sdk>@metamask/sdk-communication-layer" // we don't use the Metamask SDK in the browser
+        "GHSA-3gc7-fjrx-p6mg|@coinbase/x402>@coinbase/cdp-sdk>@solana/spl-token>@solana/buffer-layout-utils>bigint-buffer", // never gets called in our code paths
+        "GHSA-qj3p-xc97-xw74|@coinbase/x402>x402>wagmi>@wagmi/connectors>@metamask/sdk", // we don't use the Metamask SDK in the browser
+        "GHSA-qj3p-xc97-xw74|@coinbase/x402>x402>wagmi>@wagmi/connectors>@metamask/sdk>@metamask/sdk-communication-layer" // we don't use the Metamask SDK in the browser
     ]
 }
\ No newline at end of file