diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21fedab..8d45fe1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -124,8 +124,15 @@ jobs:
       # app's messages.en.xlf is missing a unit its source (WP-20) or libs/shared gains.
       - run: npx ng build ssp --localize && npx ng build behandelportal --localize
         if: needs.changes.outputs.frontend == 'true'
-      # The shipped bundle must stay clean; dev-only advisories are excluded.
-      - run: npm audit --omit=dev
+      # The shipped bundle must stay clean; dev-only advisories are excluded. The gate is
+      # `high`, not the default `low`, because two moderate Angular advisories stay open
+      # while we hold at 22.0.5: GHSA-p297-fm68-3q8c and GHSA-hh8m-fm6v-7cvg. Neither is
+      # reachable — the app calls no `withRequestsMadeViaParent` and no
+      # `provideClientHydration`, and binds no untrusted value into a directive host
+      # binding. The fix is Angular 22.1.x, which emits `var(--%NS%name)` and breaks every
+      # `--rhc-*` token. Restore `low` after an Angular release substitutes the
+      # placeholder; verify with `grep -rl '%NS%' dist/` after `npm run build`.
+      - run: npm audit --omit=dev --audit-level=high
         if: needs.changes.outputs.frontend == 'true'
 
   storybook-a11y:
diff --git a/CLAUDE.md b/CLAUDE.md
index 84d9485..bd77c94 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -58,7 +58,10 @@ catches a miss before CI does.
 
 `.npmrc` sets `legacy-peer-deps=true` (Storybook's peer range lags Angular 22).
 Do not run `npm audit fix --force` — it downgrades Angular 22→21. Dev-only
-advisories are pinned via `package.json` `overrides`; the shipped bundle audits clean.
+advisories are pinned via `package.json` `overrides`. Angular is pinned to the exact
+version 22.0.5: 22.1.x emits `var(--%NS%name)` and breaks every `--rhc-*` token, so the
+two moderate advisories it fixes stay open. Neither is reachable, so the audit gate runs
+at `--audit-level=high` (see the comment in `ci.yml`).
 
 ## Model routing for agent delegation
 
diff --git a/package-lock.json b/package-lock.json
index 24a1a5c..fb83de7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,24 +8,24 @@
       "name": "atomic-design-poc",
       "version": "0.0.0",
       "dependencies": {
-        "@angular/common": "^22.0.0",
-        "@angular/compiler": "^22.0.0",
-        "@angular/core": "^22.0.0",
-        "@angular/forms": "^22.0.0",
-        "@angular/platform-browser": "^22.0.0",
-        "@angular/router": "^22.0.0",
+        "@angular/common": "22.0.5",
+        "@angular/compiler": "22.0.5",
+        "@angular/core": "22.0.5",
+        "@angular/forms": "22.0.5",
+        "@angular/platform-browser": "22.0.5",
+        "@angular/router": "22.0.5",
         "rxjs": "~7.8.0",
         "tslib": "^2.3.0"
       },
       "devDependencies": {
-        "@angular-devkit/architect": "^0.2200.0",
-        "@angular-devkit/build-angular": "^22.0.0",
-        "@angular-devkit/core": "^22.0.0",
-        "@angular/build": "^22.0.4",
-        "@angular/cli": "^22.0.4",
-        "@angular/compiler-cli": "^22.0.0",
-        "@angular/localize": "^22.0.4",
-        "@angular/platform-browser-dynamic": "^22.0.0",
+        "@angular-devkit/architect": "0.2200.5",
+        "@angular-devkit/build-angular": "22.0.5",
+        "@angular-devkit/core": "22.0.5",
+        "@angular/build": "22.0.5",
+        "@angular/cli": "22.0.5",
+        "@angular/compiler-cli": "22.0.5",
+        "@angular/localize": "22.0.5",
+        "@angular/platform-browser-dynamic": "22.0.5",
         "@compodoc/compodoc": "^1.2.1",
         "@playwright/test": "^1.61.1",
         "@storybook/addon-a11y": "^10.4.6",
diff --git a/package.json b/package.json
index 3265575..b327676 100644
--- a/package.json
+++ b/package.json
@@ -42,24 +42,24 @@
   "private": true,
   "packageManager": "npm@11.12.1",
   "dependencies": {
-    "@angular/common": "^22.0.0",
-    "@angular/compiler": "^22.0.0",
-    "@angular/core": "^22.0.0",
-    "@angular/forms": "^22.0.0",
-    "@angular/platform-browser": "^22.0.0",
-    "@angular/router": "^22.0.0",
+    "@angular/common": "22.0.5",
+    "@angular/compiler": "22.0.5",
+    "@angular/core": "22.0.5",
+    "@angular/forms": "22.0.5",
+    "@angular/platform-browser": "22.0.5",
+    "@angular/router": "22.0.5",
     "rxjs": "~7.8.0",
     "tslib": "^2.3.0"
   },
   "devDependencies": {
-    "@angular-devkit/architect": "^0.2200.0",
-    "@angular-devkit/build-angular": "^22.0.0",
-    "@angular-devkit/core": "^22.0.0",
-    "@angular/build": "^22.0.4",
-    "@angular/cli": "^22.0.4",
-    "@angular/compiler-cli": "^22.0.0",
-    "@angular/localize": "^22.0.4",
-    "@angular/platform-browser-dynamic": "^22.0.0",
+    "@angular-devkit/architect": "0.2200.5",
+    "@angular-devkit/build-angular": "22.0.5",
+    "@angular-devkit/core": "22.0.5",
+    "@angular/build": "22.0.5",
+    "@angular/cli": "22.0.5",
+    "@angular/compiler-cli": "22.0.5",
+    "@angular/localize": "22.0.5",
+    "@angular/platform-browser-dynamic": "22.0.5",
     "@compodoc/compodoc": "^1.2.1",
     "@playwright/test": "^1.61.1",
     "@storybook/addon-a11y": "^10.4.6",
diff --git a/scripts/ci-local.sh b/scripts/ci-local.sh
index a807376..68be3d7 100755
--- a/scripts/ci-local.sh
+++ b/scripts/ci-local.sh
@@ -27,7 +27,7 @@ step "check:tokens";              npm run check:tokens
 step "check:seam";                npm run check:seam
 step "test (vitest + coverage)";  npm run test:coverage
 step "build --localize (nl+en)";  npx ng build ssp --localize; npx ng build behandelportal --localize
-step "npm audit (shipped deps)";  npm audit --omit=dev
+step "npm audit (shipped deps)";  npm audit --omit=dev --audit-level=high
 step "backend format + tests";    ( cd backend && dotnet format BigRegister.slnx --verify-no-changes && dotnet test BigRegister.slnx --filter "Category!=Integration" )
 step "backend dependency audit";  ./scripts/dotnet-audit.sh
 step "showcase snippets drift";   npm run gen:snippets; git diff --exit-code apps/ssp/src/app/showcase/snippets.generated.ts