diff --git a/.github/workflows/ci-browser-security.yml b/.github/workflows/ci-browser-security.yml
index 9aa3ccf56..054da3054 100644
--- a/.github/workflows/ci-browser-security.yml
+++ b/.github/workflows/ci-browser-security.yml
@@ -163,12 +163,23 @@ jobs:
       - name: Fail on medium or high ZAP alerts
         run: |
           test -s report_json.json || { echo "ZAP JSON report is missing"; exit 1; }
-          blocking=$(jq '[.site[]?.alerts[]? | select((.riskcode | tonumber) >= 2)] | length' report_json.json)
+          # OWASP ZAP rule 10062 (PII Disclosure) is allowlisted NARROWLY, never
+          # globally. A book catalogue renders ISBN/EAN-13 identifiers on its
+          # bibliographic pages, and a 13-digit code inherently collides with the
+          # credit-card Luhn pattern the rule matches (observed: EAN 4131672754818
+          # on /de/verlag/Puffin+Books, mis-classified as "Visa" because BIN
+          # 413167 is a Visa range). An alert is ignored ONLY when EVERY instance
+          # is a 13-digit number on a bibliographic route — a real card leak
+          # (15/16 digits) or a 13-digit value on any other page still fails the
+          # build. Real secret/PII exposure is also covered by the secret-scanning,
+          # Semgrep and CodeQL jobs; every other medium/high alert stays blocking.
+          FILTER='def is_isbn_fp: (.pluginid // "") == "10062" and ([ .instances[]? | ((.evidence // "") | test("^[0-9]{13}$")) and ((.uri // "") | test("/(auteur|author|autor|autore|book|buch|catalog|catalogo|catalogue|editore|editori|genere|genre|katalog|libro|libri|livre|publisher|verlag)"; "i")) ] | (length > 0 and all)); [ .site[]?.alerts[]? | select((.riskcode | tonumber) >= 2) | select(is_isbn_fp | not) ]'
+          blocking=$(jq "$FILTER | length" report_json.json)
           if [ "$blocking" -gt 0 ]; then
-            jq -r '.site[]?.alerts[]? | select((.riskcode | tonumber) >= 2) | "[\(.riskdesc)] \(.alert): \(.desc)"' report_json.json
+            jq -r "$FILTER"' | .[] | "[" + (.riskdesc // "") + "] " + (.alert // "") + ": " + (.desc // "")' report_json.json
             exit 1
           fi
-          echo "ZAP found no medium/high passive-scan alerts"
+          echo "ZAP found no blocking medium/high passive-scan alerts (allowlisted: 13-digit ISBN/EAN codes on bibliographic pages)"
 
       - name: Upload browser and server diagnostics
         if: always()