diff --git a/validate/deps.sh b/validate/deps.sh
index 43bde26..3af3fc1 100755
--- a/validate/deps.sh
+++ b/validate/deps.sh
@@ -32,7 +32,21 @@ if [ -n "$has_python" ]; then
   if [ -n "$has_uvlock" ]; then
     printf "   source: %s (uv project)\n" "$has_uvlock"
     pyproject_dir=$(dirname "$has_uvlock")
-    audit_cmd="uv run --directory $pyproject_dir pip-audit"
+    # Point pip-audit at the project's venv interpreter. Without this,
+    # `uv run pip-audit` ends up running the pip-audit binary from its
+    # own uv-tool install (~/.local/share/uv/tools/pip-audit/), and
+    # pip-audit then audits THAT environment instead of the project's
+    # — surfacing CVEs in pip-audit's own bundled pip/urllib3 as if
+    # they were the project's deps. See pip-audit's stderr warning
+    # ("you have a virtual environment loaded at <project>/.venv ...
+    # your local environment will not be audited") for context.
+    project_venv_python="$pyproject_dir/.venv/bin/python"
+    if [ -x "$project_venv_python" ]; then
+      audit_cmd="PIPAPI_PYTHON_LOCATION=$project_venv_python uv run --directory $pyproject_dir pip-audit"
+    else
+      printf "${YELLOW}!${NC} No project venv at %s — pip-audit may report on its own bundled deps; run \`uv sync\` and retry for an accurate audit.\n" "$project_venv_python"
+      audit_cmd="uv run --directory $pyproject_dir pip-audit"
+    fi
   elif [ -n "$has_reqtxt" ]; then
     printf "   source: %s (requirements file)\n" "$has_reqtxt"
     audit_cmd="pip-audit -r $has_reqtxt"