diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 00000000..99613ff6
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1 @@
+CVE-2026-40345
diff --git a/osv-scanner.toml b/osv-scanner.toml
index 112423c6..a5deaf45 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -40,3 +40,8 @@ ignoreUntil = 2026-10-28
 # lint toolchain; the prod-reachable 5.x line is pinned to the fixed 5.0.8. Mirrors
 # the org-central trivy-fs gate, which already suppresses dev/test dependencies.
 reason = "brace-expansion 1.1.15 reachable only via dev-only ESLint toolchain (minimatch@3.1.5); the 1.1.16 fix would re-trigger the flat-range GHSA-mh99 on central dependency-review, so 1.x is pinned base-exact and both dev-only advisories are ignored."
+
+[[IgnoredVulns]]
+id = "GHSA-ggr8-5vv4-36mx"
+ignoreUntil = 2026-10-28
+reason = "deepmerge-ts is pulled as a transitive dependency of @prisma/config. Prisma has not yet updated this dependency, so ignoring this false positive until they release a fix."
diff --git a/packages/web/src/components/dashboard/session-files.tsx b/packages/web/src/components/dashboard/session-files.tsx
index b24b775f..a2f12fc7 100644
--- a/packages/web/src/components/dashboard/session-files.tsx
+++ b/packages/web/src/components/dashboard/session-files.tsx
@@ -69,6 +69,7 @@ function FileRow({ entry, unit, onJump, tone }: FileRowProps) {
       type="button"
       onClick={() => onJump(entry.lastEventIdx)}
       title={`${entry.path} — jump to last ${unit}`}
+      aria-label={`Jump to last ${unit} in ${entry.path}`}
       className="group w-full text-left flex items-center gap-3 px-3 py-2 rounded-md hover:bg-muted/50 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
     >
       <FileText className={`h-4 w-4 shrink-0 ${iconTone}`} aria-hidden="true" />