diff --git a/lib/src/validation-server/verifications/contract-mismatcher.ts b/lib/src/validation-server/verifications/contract-mismatcher.ts
index 158cc0988..2015afacc 100644
--- a/lib/src/validation-server/verifications/contract-mismatcher.ts
+++ b/lib/src/validation-server/verifications/contract-mismatcher.ts
@@ -1,5 +1,5 @@
 import JsonSchemaValidator from "ajv";
-import Ajv from "ajv-formats";
+import addFormats from "ajv-formats";
 import assertNever from "assert-never";
 import qs from "qs";
 import * as url from "url";
@@ -413,7 +413,8 @@ export class ContractMismatcher {
       return [];
     }
 
-    const jsv = Ajv(
+    // `addFormats` adds the format validators to the instance and returns it.
+    const jsv = addFormats(
       new JsonSchemaValidator({
         verbose: true,
         allErrors: true
diff --git a/package.json b/package.json
index f5efb277e..dff3cccce 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "@oclif/help": "^1.0.15",
     "@oclif/plugin-help": "^3.2.3",
     "ajv": "^8.18.0",
-    "ajv-formats": "^2.1.1",
+    "ajv-formats": "^3.0.1",
     "assert-never": "^1.4.0",
     "cors": "^2.8.5",
     "eslint": "^10.8.1",
@@ -22,7 +22,7 @@
     "express": "^4.19.2",
     "fs-extra": "^11.4.0",
     "inquirer": "^8.1.1",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^5.2.3",
     "prettier": "^3.9.6",
     "qs": "^6.15.3",
     "randomstring": "^1.3.1",
@@ -39,7 +39,6 @@
     "@types/fs-extra": "^11.0.4",
     "@types/inquirer": "^8.1.2",
     "@types/jest": "^30.0.0",
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.1",
     "@types/qs": "^6.15.1",
     "@types/randomstring": "^1.3.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b2a9b63de..bb6e831dd 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -34,8 +34,8 @@ importers:
         specifier: ^8.18.0
         version: 8.18.0
       ajv-formats:
-        specifier: ^2.1.1
-        version: 2.1.1(ajv@8.18.0)
+        specifier: ^3.0.1
+        version: 3.0.1(ajv@8.18.0)
       assert-never:
         specifier: ^1.4.0
         version: 1.4.0
@@ -58,8 +58,8 @@ importers:
         specifier: ^8.1.1
         version: 8.2.6
       js-yaml:
-        specifier: ^4.3.1
-        version: 4.3.1
+        specifier: ^5.2.3
+        version: 5.2.3
       prettier:
         specifier: ^3.9.6
         version: 3.9.6
@@ -103,9 +103,6 @@ importers:
       '@types/jest':
         specifier: ^30.0.0
         version: 30.0.0
-      '@types/js-yaml':
-        specifier: ^4.0.9
-        version: 4.0.9
       '@types/node':
         specifier: ^22.20.1
         version: 22.20.1
@@ -934,9 +931,6 @@ packages:
   '@types/jest@30.0.0':
     resolution: {integrity: sha512-XTYugzhuwqWjws0CVz8QpM36+T+Dz5mTEBKhNs/esGLnCIlGdRy+Dq78NRjd7ls7r8BC8ZRMOrKlkO1hU0JOwA==}
 
-  '@types/js-yaml@4.0.9':
-    resolution: {integrity: sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==}
-
   '@types/json-schema@7.0.14':
     resolution: {integrity: sha512-U3PUjAudAdJBeC2pgN8uTIKgxrb4nlDF3SF0++EldXQvQBGkpFZMSnwQiIoDU77tv45VgNkl/L4ouD+rEomujw==}
 
@@ -1320,6 +1314,14 @@ packages:
       ajv:
         optional: true
 
+  ajv-formats@3.0.1:
+    resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
   ajv-keywords@3.5.2:
     resolution: {integrity: sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==}
     peerDependencies:
@@ -2736,6 +2738,10 @@ packages:
     resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
     hasBin: true
 
+  js-yaml@5.2.3:
+    resolution: {integrity: sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==}
+    hasBin: true
+
   jsep@0.3.5:
     resolution: {integrity: sha512-AoRLBDc6JNnKjNcmonituEABS5bcfqDhQAWWXNTFrqu6nVXBpBAGfcoTGZMFlIrh9FjmE1CQyX9CTNwZrXMMDA==}
     engines: {node: '>= 6.0.0'}
@@ -5299,8 +5305,6 @@ snapshots:
       expect: 30.4.1
       pretty-format: 30.4.1
 
-  '@types/js-yaml@4.0.9': {}
-
   '@types/json-schema@7.0.14': {}
 
   '@types/json-schema@7.0.15': {}
@@ -5675,6 +5679,10 @@ snapshots:
     optionalDependencies:
       ajv: 8.18.0
 
+  ajv-formats@3.0.1(ajv@8.18.0):
+    optionalDependencies:
+      ajv: 8.18.0
+
   ajv-keywords@3.5.2(ajv@6.14.0):
     dependencies:
       ajv: 6.14.0
@@ -7372,6 +7380,10 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
+  js-yaml@5.2.3:
+    dependencies:
+      argparse: 2.0.1
+
   jsep@0.3.5: {}
 
   jsep@1.4.0: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b88fdff42..84c766293 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -12,7 +12,10 @@ overrides:
 strictDepBuilds: true
 blockExoticSubdeps: true
 minimumReleaseAge: 10080
-minimumReleaseAgeExclude: "@airtasker/*"
+# A list, not a string: pnpm reads a scalar here as no exclusions and stops applying
+# minimumReleaseAge at all, so the quarantine above silently covers nothing.
+minimumReleaseAgeExclude:
+  - "@airtasker/*"
 allowBuilds:
   core-js: false
   # Reached through jest-resolve. Its postinstall only fetches a native binding when