diff --git a/.github/workflows/f6-1-fix-runtime-deps.yml b/.github/workflows/f6-1-fix-runtime-deps.yml
new file mode 100644
index 0000000..d0cc05a
--- /dev/null
+++ b/.github/workflows/f6-1-fix-runtime-deps.yml
@@ -0,0 +1,60 @@
+name: F6.1 fix runtime dependencies
+
+on:
+  push:
+    branches:
+      - 'release/f6-1-presentation-ready'
+    paths:
+      - '.github/workflows/f6-1-fix-runtime-deps.yml'
+
+permissions:
+  contents: write
+
+jobs:
+  fix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: release/f6-1-presentation-ready
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Pin patched runtime dependency resolutions
+        run: |
+          set -Eeuo pipefail
+
+          cd api-v3
+          npm pkg set overrides.multer=2.3.0 overrides.qs=6.16.0
+          npm install --package-lock-only --ignore-scripts
+          npm audit --omit=dev --audit-level=high
+          cd ..
+
+          cd web-v2
+          npm pkg set dependencies.maplibre-gl=6.4.1
+          npm install --package-lock-only --ignore-scripts
+          npm audit --omit=dev --audit-level=high
+          cd ..
+
+      - name: Verify resolved patched versions
+        run: |
+          set -Eeuo pipefail
+          grep -Fq '"multer": "2.3.0"' api-v3/package-lock.json
+          grep -Fq '"qs": "6.16.0"' api-v3/package-lock.json
+          grep -Fq '"maplibre-gl": "6.4.1"' web-v2/package.json
+          grep -Fq '"node_modules/maplibre-gl"' web-v2/package-lock.json
+          grep -Fq '"version": "6.4.1"' web-v2/package-lock.json
+
+      - name: Commit patched dependency locks
+        run: |
+          set -Eeuo pipefail
+          rm .github/workflows/f6-1-fix-runtime-deps.yml
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add api-v3/package.json api-v3/package-lock.json web-v2/package.json web-v2/package-lock.json .github/workflows/f6-1-fix-runtime-deps.yml
+          git diff --cached --check
+          git commit -m 'fix(security): patch runtime dependency advisories'
+          git push origin HEAD:release/f6-1-presentation-ready