diff --git a/.github/workflows/callable-dependency-review.yaml b/.github/workflows/callable-dependency-review.yaml
index e186044..434fd71 100644
--- a/.github/workflows/callable-dependency-review.yaml
+++ b/.github/workflows/callable-dependency-review.yaml
@@ -1,6 +1,15 @@
 name: Dependency Review
 on:
   workflow_call:
+    inputs:
+      allow-ghsas:
+        description: >-
+          Comma-separated GHSA IDs to exclude from failing the review.
+          Only for advisories already adjudicated as accepted risk in the
+          calling repo (documented in its .security-review/suppressions.json).
+        type: string
+        required: false
+        default: ''
 permissions:
   contents: read
 jobs:
@@ -11,3 +20,4 @@ jobs:
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
+          allow-ghsas: ${{ inputs.allow-ghsas }}