diff --git a/apps/api/audit-ci.jsonc b/apps/api/audit-ci.jsonc
index 9578efb2c..ee38d44ca 100644
--- a/apps/api/audit-ci.jsonc
+++ b/apps/api/audit-ci.jsonc
@@ -16,6 +16,7 @@
         "GHSA-w332-q679-j88p|@coinbase/x402>x402>wagmi>@wagmi/connectors>porto>hono", // we don't use hono
         "GHSA-73rr-hh4g-fpgx|git-diff>diff", // dev dependency for diffs, not processing user-supplied patches
         "GHSA-73rr-hh4g-fpgx|ts-node>diff", // dev dependency for TypeScript execution, not processing user-supplied patches
-        "GHSA-mp2g-9vg9-f4cg|@coinbase/x402>x402>wagmi>@wagmi/connectors>@walletconnect/ethereum-provider>@walletconnect/keyvaluestorage>unstorage>h3" // h3 is a storage dependency in x402 payment chain, not used for serving HTTP traffic
+        "GHSA-mp2g-9vg9-f4cg|@coinbase/x402>x402>wagmi>@wagmi/connectors>@walletconnect/ethereum-provider>@walletconnect/keyvaluestorage>unstorage>h3", // h3 is a storage dependency in x402 payment chain, not used for serving HTTP traffic
+        "GHSA-37qj-frw5-hhjh|@google-cloud/storage>fast-xml-parser" // XML parsing is only for Google Cloud API responses (trusted source), not user-supplied XML. Upstream uses 4.x, fix is in 5.x (breaking change).
     ]
 }
diff --git a/apps/test-site/audit-ci.jsonc b/apps/test-site/audit-ci.jsonc
index 0495a5ff5..3bb167947 100644
--- a/apps/test-site/audit-ci.jsonc
+++ b/apps/test-site/audit-ci.jsonc
@@ -6,6 +6,7 @@
         "GHSA-73rr-hh4g-fpgx|astro>diff", // dev-only dependency - we don't parse untrusted patches
         "GHSA-vw5p-8cq8-m7mv|astro>devalue", // build-time SSR hydration - no untrusted input
         "GHSA-g2pg-6438-jwpf|astro>devalue", // test site doesn't parse untrusted input
-        "GHSA-mp2g-9vg9-f4cg|astro>unstorage>h3" // test site doesn't serve production traffic
+        "GHSA-mp2g-9vg9-f4cg|astro>unstorage>h3", // test site doesn't serve production traffic
+        "GHSA-37qj-frw5-hhjh|@astrojs/rss>fast-xml-parser" // test site only - RSS generation with controlled input, not parsing untrusted XML
     ]
 }
\ No newline at end of file
diff --git a/apps/test-suite/audit-ci.jsonc b/apps/test-suite/audit-ci.jsonc
index f9a1c722a..81225629b 100644
--- a/apps/test-suite/audit-ci.jsonc
+++ b/apps/test-suite/audit-ci.jsonc
@@ -7,6 +7,9 @@
         "GHSA-5j98-mcp5-4vw2|jest>@jest/core>@jest/reporters>glob", // we do not use the glob CLI
         "GHSA-6475-r3vj-m8vf|artillery>artillery-plugin-publish-metrics>@aws-sdk/client-cloudwatch>@smithy/config-resolver", // informational enhancement - we control region input
         "GHSA-73rr-hh4g-fpgx|jest>@jest/core>jest-config>ts-node>diff", // dev-only dependency - we don't parse untrusted patches
-        "GHSA-g9mf-h72j-4rw9|artillery>@artilleryio/int-commons>cheerio>undici" // test-only dependency - load testing doesn't connect to malicious servers
+        "GHSA-g9mf-h72j-4rw9|artillery>@artilleryio/int-commons>cheerio>undici", // test-only dependency - load testing doesn't connect to malicious servers
+        "GHSA-37qj-frw5-hhjh|artillery>@aws-sdk/client-cloudwatch-logs>@aws-sdk/core>@aws-sdk/xml-builder>fast-xml-parser", // test-only dependency - controlled XML input from AWS SDK
+        "GHSA-37qj-frw5-hhjh|artillery>@azure/storage-blob>@azure/core-xml>fast-xml-parser", // test-only dependency - controlled XML input from Azure SDK
+        "GHSA-37qj-frw5-hhjh|artillery>artillery-plugin-publish-metrics>@aws-sdk/client-cloudwatch>@aws-sdk/core>fast-xml-parser" // test-only dependency - controlled XML input from AWS SDK
     ]
 }