diff --git a/Cargo.lock b/Cargo.lock
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3120,7 +3120,7 @@ checksum = "09e54e57b4c48b40f7aec75635392b12b3421fa26fe8b4332e63138ed278459c"
 [[package]]
 name = "indd"
 version = "0.1.0"
-source = "git+https://github.com/storytold/indd-utils?branch=main#7f3060e5bce78d21ea70e0d5eacb96edce15dfbe"
+source = "git+https://github.com/storytold/indd-utils?rev=7f3060e5bce78d21ea70e0d5eacb96edce15dfbe#7f3060e5bce78d21ea70e0d5eacb96edce15dfbe"
 
 [[package]]
 name = "indexmap"
diff --git a/Cargo.toml b/Cargo.toml
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -75,9 +75,12 @@ flo_curves = "0.8"
 qrcodegen = "1.8"
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
-# INDD/INDT → IDML conversion for File › Open: storytold/indd-utils, tracking its main branch
+# INDD/INDT → IDML conversion for File › Open: storytold/indd-utils, pinned by rev as every other
+# git dependency here is. It parses untrusted INDD files, and `branch = "main"` meant any
+# `cargo update` -- Dependabot runs them -- pulled whatever was on that branch into the parser
+# without review (#1599).
 # (MIT OR Apache-2.0, no dependencies, builds for wasm).
-indd = { git = "https://github.com/storytold/indd-utils", branch = "main" }
+indd = { git = "https://github.com/storytold/indd-utils", rev = "7f3060e5bce78d21ea70e0d5eacb96edce15dfbe" }
 
 # Which paths stored in documents may be followed (craft-libs).
 craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7" }