diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index cc3b5b4..49b3384 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,7 +1,14 @@
 # Token refresh, workflow, and dependency changes require owner visibility.
 /.github/CODEOWNERS @Pigbibi
-/.github/workflows/ @Pigbibi
 /main.js @Pigbibi
 /lib/ @Pigbibi
-/package.json @Pigbibi
-/package-lock.json @Pigbibi
+
+# Dependency paths below do not automatically request a personal review.
+# They still require scoped engineering review, passing CI, and applicable
+# compatibility/recovery evidence. Disabled generic auto-merge stays disabled.
+# This routing change grants no deployment, credential, or investment authority.
+# Engineering review scope: /.github/workflows/
+# Engineering review scope: /package-lock.json
+# Engineering review scope: /package.json
+# The AIAuditBridge dependency lane only covers its existing exact allowlist;
+# other dependency/workflow updates remain blocked from unattended adoption.