diff --git a/.yarnrc.yml b/.yarnrc.yml
index d91cf2aa7d..8c7e7b89b3 100644
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -4,4 +4,10 @@ enableGlobalCache: false
 
 nodeLinker: node-modules
 
+# fast-xml-parser 4.4.1 via @boxyhq/saml-jackson → @aws-sdk/core@3.816.0 (transitive).
+# Only parses trusted AWS API responses, not user input. No practical attack vector.
+# Upstream fix pending: ory/polis (saml-jackson) has bumped to @aws-sdk@3.994.0 on main but hasn't released yet.
+npmAuditIgnoreAdvisories:
+  - "1113407"
+
 yarnPath: .yarn/releases/yarn-4.12.0.cjs
diff --git a/package.json b/package.json
index ebc4728666..34930499af 100644
--- a/package.json
+++ b/package.json
@@ -158,7 +158,7 @@
     "tar": "7.5.7",
     "lodash": "4.17.23",
     "lodash-es": "4.17.23",
-    "@lingo.dev/_compiler/fast-xml-parser": "5.3.4"
+    "@lingo.dev/_compiler/fast-xml-parser": "5.3.5"
   },
   "packageExtensions": {
     "ink@3.2.0": {
diff --git a/yarn.lock b/yarn.lock
index 02df090f68..bb00aaffca 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -22683,14 +22683,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-xml-parser@npm:5.3.4":
-  version: 5.3.4
-  resolution: "fast-xml-parser@npm:5.3.4"
+"fast-xml-parser@npm:5.3.5":
+  version: 5.3.5
+  resolution: "fast-xml-parser@npm:5.3.5"
   dependencies:
-    strnum: "npm:^2.1.0"
+    strnum: "npm:^2.1.2"
   bin:
     fxparser: src/cli/cli.js
-  checksum: 10/0d7e6872fed7c3065641400d43cdf24c03177f05c343bfb31df53b79f0900b085c103f647852d0b00693125aa3f0e9d8b8cfc4273b168d4da0308f857dafe830
+  checksum: 10/913363c2cf9ab8038bd2b666698d99d44b977725f0198f3dfff3a5d34c3109ef49d3a163a0f390f69ed00ad33b81355112dec8be5e79a13f8e6c7aaf146204b8
   languageName: node
   linkType: hard
 
@@ -36299,10 +36299,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strnum@npm:^2.1.0":
-  version: 2.1.1
-  resolution: "strnum@npm:2.1.1"
-  checksum: 10/d5fe6e4333cddc17569331048e403e876ffcf629989815f0359b0caf05dae9441b7eef3d7dd07427313ac8b3f05a8f60abc1f61efc15f97245dbc24028362bc9
+"strnum@npm:^2.1.2":
+  version: 2.1.2
+  resolution: "strnum@npm:2.1.2"
+  checksum: 10/7d894dff385e3a5c5b29c012cf0a7ea7962a92c6a299383c3d6db945ad2b6f3e770511356a9774dbd54444c56af1dc7c435dad6466c47293c48173274dd6c631
   languageName: node
   linkType: hard