diff --git a/.gitignore b/.gitignore
index 8dedd0fda..acde0fba4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,6 +34,15 @@ renderer/output/*.png
 spikes/**/.godot/
 spikes/**/*.import
 spikes/**/*.uid
+spikes/**/*.npy
+spikes/**/*.npz
+
+# Planet generator intermediates
+tooling/planet-gen/__pycache__/
+*.tmp.npz
+
+# Generated terrain grids (large, regenerated from pipeline)
+wiki/**/bodies/**/terrain.npz
 
 # Asset downloads (vendor archives, not game content)
 docs/assets/downloads/
diff --git a/pyproject.toml b/pyproject.toml
index 5bfab990d..605305b31 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,6 +6,11 @@ dependencies = [
     "PyYAML",
     "jsonschema",
     "numpy",
+    # scipy 1.17.1 — checked clean against NVD + OSV, no CVEs on record (2026-04-06)
+    "scipy==1.17.1",
+    # Pillow 12.2.0 — checked clean against NVD + OSV (2026-04-06)
+    # CVE-2026-25990 fixed in 12.1.1, CVE-2025-48379 fixed in 11.3.0
+    "Pillow==12.2.0",
 ]
 
 [project.optional-dependencies]