diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4f6c18..20015a9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,16 @@ jobs:
       - name: Build
         run: ./node_modules/.bin/subql build pezkuwi.yaml
 
+      # Dependency Review allows the @subql packages because the mapping imports
+      # only their types; this is the check that keeps it true. A type-only
+      # import is erased on emit, a value import survives as a require.
+      - name: The mapping imports no @subql code
+        run: |
+          out=$(mktemp -d)
+          ./node_modules/.bin/tsc -p tsconfig.json --outDir "$out" --declaration false
+          ! grep -rn 'require("@subql/' "$out" || {
+            echo "the mapping imports @subql code; import its types with 'import type' or drop it"; exit 1; }
+
   # The noter and payout bots ship as their own images (docker-compose.prod.yml)
   # and nothing else here builds or runs them. Build each image as production
   # does, then run inside it: the crypto stack must be the locked one and sign
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index add3107..479523a 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -61,10 +61,22 @@ jobs:
           # with --omit=optional and never contain it (checked in ci.yml, bots).
           # TruffleHog (AGPL-3.0) is the secret scanner this workflow runs; it
           # executes in CI and is never shipped, served or distributed.
+          # The @subql packages make up the SubQuery indexer that runs the
+          # mapping; the mapping imports only their types, so the bundle this
+          # repo builds carries none of their code (checked in ci.yml, build).
           allow-dependencies-licenses: >-
             pkg:npm/@bizinikiwi/connect,
             pkg:npm/@bizinikiwi/connect-extension-protocol,
             pkg:npm/@bizinikiwi/connect-known-chains,
+            pkg:npm/@subql/cli,
+            pkg:npm/@subql/common,
+            pkg:npm/@subql/common-substrate,
+            pkg:npm/@subql/node,
+            pkg:npm/@subql/node-core,
+            pkg:npm/@subql/testing,
+            pkg:npm/@subql/types,
+            pkg:npm/@subql/types-core,
+            pkg:npm/@subql/utils,
             pkg:githubactions/trufflesecurity/trufflehog
 
   secret-scan: