diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index cefa8f4d3..a7efcad8c 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -28,10 +28,14 @@ jobs:
           # PR #295: vite/vitest tree (BlueOak-1.0.0, MPL-2.0 lightningcss), type-fest (CC0-1.0),
           # rollup@4.x compound SPDX (0BSD AND ISC AND MIT).
           # FSL-1.1-MIT is not a valid SPDX id for allow-licenses — exclude @sentry/* via purls.
+          # caniuse-lite ships MIT code but a CC-BY-4.0 dataset; the scanner reports the data
+          # license, which is not code we redistribute. It updates on nearly every browserslist
+          # refresh, so allow it by purl rather than adding CC-BY-4.0 to the global allow-licenses.
           allow-licenses: >-
             MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Python-2.0,
             BlueOak-1.0.0, MPL-2.0, CC0-1.0, 0BSD
           allow-dependencies-licenses: >-
+            pkg:npm/caniuse-lite,
             pkg:npm/@sentry/nextjs,
             pkg:npm/@sentry/cli,
             pkg:npm/@sentry/cli-darwin,