diff --git a/CHANGELOG.md b/CHANGELOG.md
index f373363..0da8284 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ Lanes uses [semantic versioning](https://semver.org), and 0.0.x versions are pre
 
 ## Unreleased
 
+### 2026-10-30
+
+- `18:15` **Security**: the install count worker and the site pin fixed releases of npm packages with advisories: undici 6.29.1 (GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-f72v-6w45-q472) and fast-uri 2.4.8 (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr).
+
 ### 2026-10-19
 
 - `16:45` **Changed**: benchmark 1 measures wall time and disk in separate passes, so a full run fits a night or two per disk instead of days. The time pass runs 1 warmup and 10 runs back to back, removing the copies between runs without waiting. The disk pass runs 3 times per measurement, each run starting and ending on a settled disk, and goes first so the time pass's deletes never reach its numbers. The results file says which pass each number came from. `--pass time|disk|both` (`-Pass`) runs one or both, and `--disk-runs` (`-DiskRuns`) sets the disk runs. (`1fc6de1`)
diff --git a/services/install-count/package-lock.json b/services/install-count/package-lock.json
index ea8d7d1..e1055bc 100644
--- a/services/install-count/package-lock.json
+++ b/services/install-count/package-lock.json
@@ -2450,7 +2450,7 @@
       "dependencies": {
         "@cspotcode/source-map-support": "0.8.1",
         "sharp": "0.35.5",
-        "undici": "7.29.1",
+        "undici": "6.29.1",
         "workerd": "1.20261012.1",
         "ws": "8.21.0",
         "youch": "4.1.0-beta.10"
@@ -2768,13 +2768,13 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
-      "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
+      "version": "6.29.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",
+      "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=20.18.1"
+        "node": ">=18.17"
       }
     },
     "node_modules/unenv": {
diff --git a/services/install-count/test/deps.test.ts b/services/install-count/test/deps.test.ts
new file mode 100644
index 0000000..e300396
--- /dev/null
+++ b/services/install-count/test/deps.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+
+describe("security pins", () => {
+  // The install-count worker's lockfile must keep undici on the advisory-fixed
+  // release (GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c,
+  // GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-4w7w-5xrc-9h26,
+  // GHSA-55wc-3pg8-jfw6, GHSA-f72v-6w45-q472).
+  it("locks undici to 6.29.1", () => {
+    const lock = JSON.parse(readFileSync(new URL("../package-lock.json", import.meta.url), "utf8"));
+    const undici = lock.packages?.["node_modules/undici"];
+    expect(undici?.version).toBe("6.29.1");
+  });
+});
diff --git a/site/package-lock.json b/site/package-lock.json
index aa72a19..30394f1 100644
--- a/site/package-lock.json
+++ b/site/package-lock.json
@@ -1924,7 +1924,7 @@
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
+        "fast-uri": "^2.4.8",
         "json-schema-traverse": "^1.0.0",
         "require-from-string": "^2.0.2"
       },
@@ -2598,21 +2598,11 @@
       }
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "2.4.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-2.4.8.tgz",
+      "integrity": "sha512-knw8ym69bDOF980l2z0tDKh7XB9zfsUmpMmoQUx9KskazmddvnhNntiTzen4VsiW7qVWiVZkrcd5Pj2bziC3gA==",
       "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
+      "license": "MIT"
     },
     "node_modules/fast-wrap-ansi": {
       "version": "0.2.2",