diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json
new file mode 100644
index 0000000..f2cb9a0
--- /dev/null
+++ b/.security-review/suppressions.json
@@ -0,0 +1,12 @@
+{
+  "suppressions": [
+    {
+      "id": "checkov-CKV_AWS_109-13",
+      "justification": "False positive. bootstrap.yaml ExecRole (line 13) is a CloudFormation execution role assumable ONLY by cloudformation.amazonaws.com and gated by aws:SourceAccount == this account. CKV_AWS_109 fires on the IAM user actions (iam:CreateUser/PutUserPolicy in the ExportUser block), but those are ARN-scoped to arn:aws:iam::${AWS::AccountId}:user/sh-openswe-traces-* (not Resource:*), AND the explicit DenyUserCredentialAndEscalation block denies CreateAccessKey/CreateLoginProfile/UpdateLoginProfile/AttachUserPolicy/CreateServiceSpecificCredential and boundary tampering, so any created user is credential-inert. No privesc path. iam:PassRole is conditioned to cloudformation.amazonaws.com. Verified proof-or-kill 2026-07-13."
+    },
+    {
+      "id": "checkov-CKV_AWS_111-13",
+      "justification": "False positive. Same ExecRole. CKV_AWS_111 (write without constraint on Resource:*) fires on the KMS block (kms:CreateKey/CreateAlias), which is inherent to key creation — not-yet-existent keys cannot be ARN-scoped — with blast radius bounded to this stack's deploys. The other Resource:* statement is a Deny (flagging a Deny as over-permissive is nonsensical). CFN-only assumable, SourceAccount-conditioned. Verified proof-or-kill 2026-07-13."
+    }
+  ]
+}