diff --git a/.github/workflows/code-coverage.yaml b/.github/workflows/code-coverage.yaml
index bfc1b3a..54e690c 100644
--- a/.github/workflows/code-coverage.yaml
+++ b/.github/workflows/code-coverage.yaml
@@ -35,7 +35,7 @@ jobs:
         cache: 'pnpm'
 
     - name: Install Dependencies
-      run: pnpm install
+      run: pnpm install --frozen-lockfile
 
     - name: Build    
       run: pnpm build
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4ba47d9..3d4298f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -35,7 +35,7 @@ jobs:
         cache: 'pnpm'
 
     - name: Install Dependencies
-      run: pnpm install
+      run: pnpm install --frozen-lockfile
 
     - name: Build
       run: pnpm build
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 81c6bda..44da9d9 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -39,7 +39,7 @@ jobs:
         cache: 'pnpm'
 
     - name: Install Dependencies
-      run: pnpm install
+      run: pnpm install --frozen-lockfile
 
     - name: Build
       run: pnpm build
diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md
index 20dd8d1..4ecad6e 100644
--- a/DEFENSE_IN_DEPTH.md
+++ b/DEFENSE_IN_DEPTH.md
@@ -20,8 +20,8 @@ Profile: npm library · public
 - [x] 7-day cooldown: `minimumReleaseAge: 10080`, `minimumReleaseAgeStrict: true`, `minimumReleaseAgeIgnoreMissingTime: false`; no first-party `minimumReleaseAgeExclude` — PR #162
 - [x] `trustPolicy: no-downgrade`; no first-party `trustPolicyExclude` — PR #163
 - [x] Lifecycle scripts blocked: `strictDepBuilds: true`, `dangerouslyAllowAllBuilds: false`, `allowBuilds: {}` baseline — PR #164
-- [ ] `blockExoticSubdeps: true` (PR #165 pending)
-- [ ] Lockfile committed; CI installs with `pnpm install --frozen-lockfile`
+- [x] `blockExoticSubdeps: true` — PR #165
+- [ ] Lockfile committed; CI installs with `pnpm install --frozen-lockfile` (PR #166 pending)
 - [x] No `.github/dependabot.yml`; other dependency-update tools (if any) open PRs only — never auto-merge — verified 2026-10-08
 
 ## 4. GitHub Actions