diff --git a/package-lock.json b/package-lock.json
index 07ed139d..ce9efe01 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8085,16 +8085,16 @@
 			"license": "MIT"
 		},
 		"node_modules/uuid": {
-			"version": "11.1.0",
-			"resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
-			"integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+			"version": "14.0.0",
+			"resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
+			"integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
 			"funding": [
 				"https://github.com/sponsors/broofa",
 				"https://github.com/sponsors/ctavan"
 			],
 			"license": "MIT",
 			"bin": {
-				"uuid": "dist/esm/bin/uuid"
+				"uuid": "dist-node/bin/uuid"
 			}
 		},
 		"node_modules/vite": {
@@ -8626,7 +8626,7 @@
 				"strip-ansi": "^7.1.0",
 				"typebox": "^1.1.24",
 				"undici": "^7.19.1",
-				"uuid": "^11.1.0",
+				"uuid": "^14.0.0",
 				"yaml": "^2.8.2"
 			},
 			"bin": {
diff --git a/packages/coding-agent/CHANGELOG.md b/packages/coding-agent/CHANGELOG.md
index 5ca41e74..43714316 100644
--- a/packages/coding-agent/CHANGELOG.md
+++ b/packages/coding-agent/CHANGELOG.md
@@ -8,6 +8,7 @@
 
 ### Fixed
 
+- Fixed `pi-coding-agent` shipping `uuid@11`, which triggered `npm audit` moderate vulnerability reports for downstream installs; the package now depends on `uuid@14` ([#3577](https://github.com/badlogic/pi-mono/issues/3577))
 - Fixed `ctx.ui.setWorkingMessage()` to persist across loader recreation, matching the behavior of `ctx.ui.setWorkingIndicator()` ([#3566](https://github.com/badlogic/pi-mono/issues/3566))
 - Fixed coding-agent `fs.watch` error handling for theme and git-footer watchers to retry after transient watcher failures such as `EMFILE`, avoiding startup crashes in large repos ([#3564](https://github.com/badlogic/pi-mono/issues/3564))
 
diff --git a/packages/coding-agent/package.json b/packages/coding-agent/package.json
index 38b8e6b6..95e53055 100644
--- a/packages/coding-agent/package.json
+++ b/packages/coding-agent/package.json
@@ -43,7 +43,6 @@
 		"@mariozechner/pi-ai": "^0.69.0",
 		"@mariozechner/pi-tui": "^0.69.0",
 		"@silvia-odwyer/photon-node": "^0.3.4",
-		"typebox": "^1.1.24",
 		"chalk": "^5.5.0",
 		"cli-highlight": "^2.1.11",
 		"diff": "^8.0.2",
@@ -56,8 +55,9 @@
 		"minimatch": "^10.2.3",
 		"proper-lockfile": "^4.1.2",
 		"strip-ansi": "^7.1.0",
+		"typebox": "^1.1.24",
 		"undici": "^7.19.1",
-		"uuid": "^11.1.0",
+		"uuid": "^14.0.0",
 		"yaml": "^2.8.2"
 	},
 	"overrides": {