diff --git a/.changeset/fuzzy-taxis-smile.md b/.changeset/fuzzy-taxis-smile.md
new file mode 100644
index 000000000..4c3612eac
--- /dev/null
+++ b/.changeset/fuzzy-taxis-smile.md
@@ -0,0 +1,5 @@
+---
+'@rock-js/config': patch
+---
+
+Require Joi 17.13.6 or newer to prevent prototype pollution through localized validation messages.
diff --git a/packages/config/package.json b/packages/config/package.json
index 83d39d1a7..65e16af04 100644
--- a/packages/config/package.json
+++ b/packages/config/package.json
@@ -21,7 +21,7 @@
     "@babel/code-frame": "^7.26.2",
     "@rock-js/provider-github": "^0.15.1",
     "@rock-js/tools": "^0.15.1",
-    "joi": "^17.13.3",
+    "joi": "^17.13.6",
     "tslib": "^2.3.0"
   },
   "devDependencies": {
diff --git a/packages/config/src/lib/__tests__/schema.test.ts b/packages/config/src/lib/__tests__/schema.test.ts
new file mode 100644
index 000000000..5c21869fb
--- /dev/null
+++ b/packages/config/src/lib/__tests__/schema.test.ts
@@ -0,0 +1,16 @@
+import { expect, test } from 'vitest';
+import { ConfigTypeSchema } from '../schema.js';
+
+test('does not allow Joi message localization to pollute Object.prototype', () => {
+  const pollutionKey = 'rnefPrototypePollutionRegression';
+
+  try {
+    ConfigTypeSchema.messages({
+      ['__proto__']: { [pollutionKey]: 'polluted' },
+    });
+
+    expect(Object.prototype).not.toHaveProperty(pollutionKey);
+  } finally {
+    Reflect.deleteProperty(Object.prototype, pollutionKey);
+  }
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7b5a172f1..6660076e3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -195,8 +195,8 @@ importers:
         specifier: ^0.15.1
         version: link:../tools
       joi:
-        specifier: ^17.13.3
-        version: 17.13.3
+        specifier: ^17.13.6
+        version: 17.13.6
       tslib:
         specifier: ^2.3.0
         version: 2.8.1
@@ -5729,6 +5729,9 @@ packages:
   joi@17.13.3:
     resolution: {integrity: sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==}
 
+  joi@17.13.6:
+    resolution: {integrity: sha512-ImNZaq/LSysofih+xIGYfR0WUXMA9GLUNB//YTCSrZptoRmVgaNAdJyi6K1kXi9pkLEoSkoI8I4UwtNiu/D7nw==}
+
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -15505,6 +15508,14 @@ snapshots:
       '@sideway/formula': 3.0.1
       '@sideway/pinpoint': 2.0.0
 
+  joi@17.13.6:
+    dependencies:
+      '@hapi/hoek': 9.3.0
+      '@hapi/topo': 5.1.0
+      '@sideway/address': 4.1.5
+      '@sideway/formula': 3.0.1
+      '@sideway/pinpoint': 2.0.0
+
   js-tokens@4.0.0: {}
 
   js-tokens@9.0.1: {}