diff --git a/supabase/functions/caterium-create-employee/deno.json b/supabase/functions/caterium-create-employee/deno.json
index 15d0809..110d6f5 100644
--- a/supabase/functions/caterium-create-employee/deno.json
+++ b/supabase/functions/caterium-create-employee/deno.json
@@ -1,5 +1,5 @@
 {
   "imports": {
-    "@supabase/supabase-js": "npm:@supabase/supabase-js@2"
+    "@supabase/supabase-js": "npm:@supabase/supabase-js@2.116.0"
   }
 }
diff --git a/tests/edge-security-v1774.mjs b/tests/edge-security-v1774.mjs
index 08b4f34..5f048f2 100644
--- a/tests/edge-security-v1774.mjs
+++ b/tests/edge-security-v1774.mjs
@@ -1,7 +1,10 @@
 import fs from 'node:fs';
 const src=fs.readFileSync('supabase/functions/caterium-create-employee/index.ts','utf8');
+const importMap=fs.readFileSync('supabase/functions/caterium-create-employee/deno.json','utf8');
 let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++};
-check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS is pinned');
+check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS direct import is pinned');
+check(importMap.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS import map is pinned');
+check(!importMap.includes('npm:@supabase/supabase-js@2"'),'broad Supabase JS import map is removed');
 check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is removed');
 check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted');
 check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');