diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92dc944..4c5fa38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,6 +37,7 @@ jobs:
   # with every key type, and the bot must load its whole module graph and stop
   # only where it reads the mnemonic that CI does not have.
   bots:
+    name: bots (${{ matrix.bot }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -56,6 +57,13 @@ jobs:
       - name: Build the image
         run: docker build -t bot ${{ matrix.bot }}
 
+      # Dependency Review allows these GPL-3.0 packages in the lockfiles only
+      # because no image installs them; this is the check that keeps it true.
+      - name: No light client in the image
+        run: |
+          docker run --rm bot sh -c '! [ -e node_modules/@bizinikiwi ] && ! [ -e node_modules/smoldot ]' || {
+            echo "the image installs the light client; it must be built with --omit=optional"; exit 1; }
+
       - name: Crypto stack
         run: docker run --rm -v "$PWD/scripts/bot-smoke.mjs:/app/bot-smoke.mjs:ro" bot node bot-smoke.mjs ${{ matrix.mode }}
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 57553f4..ecafc28 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -56,6 +56,13 @@ jobs:
         with:
           fail-on-severity: high
           deny-licenses: GPL-3.0, AGPL-3.0
+          # The light client is an optional dependency of @pezkuwi/rpc-provider,
+          # so it is listed in the bots' lockfiles, but their images are built
+          # with --omit=optional and never contain it (checked in ci.yml, bots).
+          allow-dependencies-licenses: >-
+            pkg:npm/@bizinikiwi/connect,
+            pkg:npm/@bizinikiwi/connect-extension-protocol,
+            pkg:npm/@bizinikiwi/connect-known-chains
 
   secret-scan:
     name: Secret Scan
diff --git a/noter/Dockerfile b/noter/Dockerfile
index 125592c..b14b6c9 100644
--- a/noter/Dockerfile
+++ b/noter/Dockerfile
@@ -4,9 +4,11 @@ WORKDIR /app
 
 # Install exactly what package-lock.json records, so the image runs the
 # versions that were reviewed and tested rather than whatever the ranges
-# resolve to on the day it is built.
+# resolve to on the day it is built. The optional dependencies are the light
+# client (@bizinikiwi/connect, smoldot), which the bot never loads: it talks to
+# the chains over WsProvider.
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --no-audit --no-fund
+RUN npm ci --omit=dev --omit=optional --no-audit --no-fund
 
 COPY bot.js ./
 
diff --git a/payout-bot/Dockerfile b/payout-bot/Dockerfile
index 125592c..b14b6c9 100644
--- a/payout-bot/Dockerfile
+++ b/payout-bot/Dockerfile
@@ -4,9 +4,11 @@ WORKDIR /app
 
 # Install exactly what package-lock.json records, so the image runs the
 # versions that were reviewed and tested rather than whatever the ranges
-# resolve to on the day it is built.
+# resolve to on the day it is built. The optional dependencies are the light
+# client (@bizinikiwi/connect, smoldot), which the bot never loads: it talks to
+# the chains over WsProvider.
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --no-audit --no-fund
+RUN npm ci --omit=dev --omit=optional --no-audit --no-fund
 
 COPY bot.js ./