diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml
index 0f88a761..290bcd5c 100644
--- a/.github/workflows/dependency-scan.yml
+++ b/.github/workflows/dependency-scan.yml
@@ -38,34 +38,24 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "20"
-          cache: "npm"
+          cache: "pnpm"
+
+      - name: Enable Corepack
+        run: corepack enable
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Run npm audit
         id: npm-audit
         continue-on-error: true
-        run: npm audit --audit-level=moderate
-
-      - name: Generate SARIF report
-        if: always()
-        run: |
-          npm audit --json > audit-report.json || true
-          npm audit --json --production > audit-report-prod.json || true
+        run: pnpm audit --audit-level=moderate
 
-      - name: Convert audit to SARIF
+      - name: Generate audit reports
         if: always()
         run: |
-          npm install -g npm-audit-to-sarif
-          npm-audit-to-sarif audit-report.json --output audit.sarif || true
-
-      - name: Upload SARIF to GitHub Security
-        if: always()
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: audit.sarif
-          category: npm-audit
+          pnpm audit --json > audit-report.json || true
+          pnpm audit --json --prod > audit-report-prod.json || true
 
       - name: Comment on PR with audit results
         if: github.event_name == 'pull_request' && failure()
@@ -97,10 +87,18 @@ jobs:
             });
 
       - name: Fail if critical vulnerabilities found
-        if: steps.npm-audit.outcome == 'failure'
+        if: always()
         run: |
-          echo "🚨 Security vulnerabilities found in dependencies"
-          exit 1
+          node -e "
+            const fs = require('fs');
+            const audit = JSON.parse(fs.readFileSync('audit-report.json', 'utf-8'));
+            const critical = audit?.metadata?.vulnerabilities?.critical || 0;
+            if (critical > 0) {
+              console.error(\`🚨 Critical vulnerabilities found: \${critical}\`);
+              process.exit(1);
+            }
+            console.log('✅ No critical vulnerabilities found');
+          "
 
   snyk-scan:
     name: Snyk Dependency Scanning