diff --git a/package.json b/package.json
index f32e54a..afae8f0 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "uuid": "^11.1.1",
     "postcss": "^8.5.18",
     "postcss-selector-parser@^6.0.0": "^6.1.3",
-    "http-cache-semantics": "^4.3.0",
+    "http-cache-semantics@^4.0.0": "^4.3.0",
     "js-yaml@^3.0.0": "^3.15.2",
     "js-yaml@^4.0.0": "^4.3.2",
     "brace-expansion@^1.0.0": "^1.1.21",
diff --git a/tests/smoke.test.cjs b/tests/smoke.test.cjs
index e9ae2cc..78cfb23 100644
--- a/tests/smoke.test.cjs
+++ b/tests/smoke.test.cjs
@@ -307,7 +307,7 @@ check('every installed undici copy is >= 6.28.1', () => {
 });
 
 // --- Override floors (#128, #129) ---
-// http-cache-semantics: blanket floor, a single copy (@expo/ngrok > got).
+// http-cache-semantics: version-scoped to major 4, a single copy (@expo/ngrok > got).
 // postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline);
 // any other major is unexpected and must fail loudly.