diff --git a/.github/osv-release.toml b/.github/osv-release.toml
index 9e9ae93d..0e900e17 100644
--- a/.github/osv-release.toml
+++ b/.github/osv-release.toml
@@ -1,13 +1,3 @@
 [[IgnoredVulns]]
 id = "GHSA-j965-2qgj-vjmq"
 reason = "aws-sdk v2 has no fixed version reported by OSV. It is retained only as a transitive package while release artifacts are built with scripts disabled, SBOM, and provenance attestations."
-
-[[IgnoredVulns]]
-id = "GHSA-4mjr-xmp4-gh2g"
-ignoreUntil = 2026-09-07
-reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-x5fp-wj9c-mxmx"
-ignoreUntil = 2026-09-07
-reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d94995ec..17a17618 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,8 @@
 
 ### Fixed
 
+- Update the transitive query-string parser to `qs 6.16.0`, fixing
+  GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx without extending expired exceptions.
 - Normalize replayed tool arguments and bound connection retry behavior.
 - Fence targeted turn and shell cancellation without escalating a stale target
   into an unrelated global abort.
diff --git a/src/mendcode/package.json b/src/mendcode/package.json
index d75e85c6..d1d930e8 100644
--- a/src/mendcode/package.json
+++ b/src/mendcode/package.json
@@ -164,7 +164,7 @@
     "mysql2": "3.23.1",
     "postcss-selector-parser": "7.1.3",
     "protobufjs": "7.6.3",
-    "qs": "6.15.2",
+    "qs": "6.16.0",
     "seroval": "1.5.3",
     "shell-quote": "1.9.0",
     "sigstore": "4.1.1",
diff --git a/src/mendcode/pnpm-lock.yaml b/src/mendcode/pnpm-lock.yaml
index 005a27fc..14ea13d3 100644
--- a/src/mendcode/pnpm-lock.yaml
+++ b/src/mendcode/pnpm-lock.yaml
@@ -172,7 +172,7 @@ overrides:
   mysql2: 3.23.1
   postcss-selector-parser: 7.1.3
   protobufjs: 7.6.3
-  qs: 6.15.2
+  qs: 6.16.0
   seroval: 1.5.3
   shell-quote: 1.9.0
   sigstore: 4.1.1
@@ -5971,8 +5971,8 @@ packages:
   pure-rand@8.4.2:
     resolution: {integrity: sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==}
 
-  qs@6.15.2:
-    resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
+  qs@6.16.0:
+    resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==}
     engines: {node: '>=0.6'}
 
   quansync@0.2.11:
@@ -10678,7 +10678,7 @@ snapshots:
       http-errors: 2.0.1
       iconv-lite: 0.7.3
       on-finished: 2.4.1
-      qs: 6.15.2
+      qs: 6.16.0
       raw-body: 3.0.2
       type-is: 2.1.0
     transitivePeerDependencies:
@@ -11212,7 +11212,7 @@ snapshots:
       once: 1.4.0
       parseurl: 1.3.3
       proxy-addr: 2.0.7
-      qs: 6.15.2
+      qs: 6.16.0
       range-parser: 1.3.0
       router: 2.2.0
       send: 1.2.1
@@ -12590,8 +12590,9 @@ snapshots:
 
   pure-rand@8.4.2: {}
 
-  qs@6.15.2:
+  qs@6.16.0:
     dependencies:
+      es-define-property: 1.0.1
       side-channel: 1.1.1
 
   quansync@0.2.11: {}
diff --git a/src/mendcode/pnpm-workspace.yaml b/src/mendcode/pnpm-workspace.yaml
index 1b68978c..8cb9f84b 100644
--- a/src/mendcode/pnpm-workspace.yaml
+++ b/src/mendcode/pnpm-workspace.yaml
@@ -106,7 +106,7 @@ overrides:
   "mysql2": "3.23.1"
   "postcss-selector-parser": "7.1.3"
   "protobufjs": "7.6.3"
-  "qs": "6.15.2"
+  "qs": "6.16.0"
   "seroval": "1.5.3"
   "shell-quote": "1.9.0"
   "sigstore": "4.1.1"