diff --git a/package-lock.json b/package-lock.json
index 9b9783a..795a1e3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7068,9 +7068,9 @@
       }
     },
     "node_modules/http-cache-semantics": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz",
+      "integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==",
       "license": "BSD-2-Clause"
     },
     "node_modules/http-errors": {
@@ -9682,9 +9682,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
diff --git a/package.json b/package.json
index bece00d..f32e54a 100644
--- a/package.json
+++ b/package.json
@@ -71,6 +71,8 @@
     "@xmldom/xmldom": "^0.8.15",
     "uuid": "^11.1.1",
     "postcss": "^8.5.18",
+    "postcss-selector-parser@^6.0.0": "^6.1.3",
+    "http-cache-semantics": "^4.3.0",
     "js-yaml@^3.0.0": "^3.15.2",
     "js-yaml@^4.0.0": "^4.3.2",
     "brace-expansion@^1.0.0": "^1.1.21",
diff --git a/tests/smoke.test.cjs b/tests/smoke.test.cjs
index 602ac52..e9ae2cc 100644
--- a/tests/smoke.test.cjs
+++ b/tests/smoke.test.cjs
@@ -306,6 +306,35 @@ check('every installed undici copy is >= 6.28.1', () => {
   );
 });
 
+// --- Override floors (#128, #129) ---
+// http-cache-semantics: blanket floor, a single copy (@expo/ngrok > got).
+// postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline);
+// any other major is unexpected and must fail loudly.
+
+check('every installed http-cache-semantics copy is >= 4.3.0', () => {
+  const copies = installedCopies('http-cache-semantics');
+  assert.ok(copies.length > 0, 'http-cache-semantics is not installed');
+  const strays = copies.filter((c) => !versionAtLeast(c.version, '4.3.0'));
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'http-cache-semantics must be >= 4.3.0'
+  );
+});
+
+check('every installed postcss-selector-parser copy is 6.x and >= 6.1.3', () => {
+  const copies = installedCopies('postcss-selector-parser');
+  assert.ok(copies.length > 0, 'postcss-selector-parser is not installed');
+  const strays = copies.filter(
+    (c) => majorOf(c.version) !== '6' || !versionAtLeast(c.version, '6.1.3')
+  );
+  assert.deepEqual(
+    strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
+    [],
+    'postcss-selector-parser must be 6.x >= 6.1.3'
+  );
+});
+
 // The call that broke under the blanket override: each minimatch copy must
 // still expand braces through its own brace-expansion major.
 check('every installed minimatch copy still matches globs and braces', () => {