diff --git a/containers/libreportal/frontend/components/updater/css/updater.css b/containers/libreportal/frontend/components/updater/css/updater.css
index 02cb4a4..c1ac38f 100644
--- a/containers/libreportal/frontend/components/updater/css/updater.css
+++ b/containers/libreportal/frontend/components/updater/css/updater.css
@@ -88,6 +88,18 @@
 .updater-cve-pkg { color: rgba(var(--text-rgb), 0.6); }
 .updater-cve-fix { margin-left: auto; color: rgba(var(--page-verify-rgb), 0.9); font-size: 0.76rem; }
 
+/* Security CVEs live in their own inset dark panel so the list reads as a
+   contained block with breathing room on both sides — matching the app rows
+   instead of bleeding to the detail-panel edges. The rows themselves keep no
+   horizontal padding; the box supplies it. */
+.updater-cve-box {
+  padding: 2px 14px;
+  border-radius: 10px;
+  background: rgba(10, 16, 32, 0.45);
+  border: 1px solid rgba(var(--text-rgb), 0.10);
+}
+.updater-cve-box .updater-cve:first-child { border-top: 0; }
+
 /* Count pill next to the "Security" detail heading (e.g. "Security 28"). */
 .updater-cve-count {
   display: inline-block; vertical-align: middle; margin-left: 4px;
@@ -110,12 +122,15 @@
   -webkit-mask-image: linear-gradient(to bottom, #000 calc(100% - 18px), transparent 100%);
           mask-image: linear-gradient(to bottom, #000 calc(100% - 18px), transparent 100%);
 }
-.updater-cve-scroll.is-scrollable::-webkit-scrollbar { width: 8px; }
-.updater-cve-scroll.is-scrollable::-webkit-scrollbar-track { background: transparent; }
-.updater-cve-scroll.is-scrollable::-webkit-scrollbar-thumb {
-  background: rgba(var(--text-rgb), 0.22); border-radius: 999px;
+.updater-cve-scroll.is-scrollable::-webkit-scrollbar { width: 9px; }
+.updater-cve-scroll.is-scrollable::-webkit-scrollbar-track {
+  background: rgba(var(--text-rgb), 0.05); border-radius: 999px;
 }
-.updater-cve-scroll.is-scrollable::-webkit-scrollbar-thumb:hover { background: rgba(var(--text-rgb), 0.34); }
+.updater-cve-scroll.is-scrollable::-webkit-scrollbar-thumb {
+  background: rgba(var(--text-rgb), 0.38); border-radius: 999px;
+  border: 2px solid transparent; background-clip: padding-box;
+}
+.updater-cve-scroll.is-scrollable::-webkit-scrollbar-thumb:hover { background: rgba(var(--text-rgb), 0.55); background-clip: padding-box; }
 
 /* ---- Buttons ---- */
 .updater-btn {
diff --git a/containers/libreportal/frontend/components/updater/js/updater-page.js b/containers/libreportal/frontend/components/updater/js/updater-page.js
index e3d6aa0..e7bd2af 100644
--- a/containers/libreportal/frontend/components/updater/js/updater-page.js
+++ b/containers/libreportal/frontend/components/updater/js/updater-page.js
@@ -496,7 +496,7 @@ class UpdaterPage {
     const cves = a.cves || [];
     const security = `<div class="updater-detail-section"><h4>Security${
       cves.length ? ` <span class="updater-cve-count">${cves.length}</span>` : ''}</h4>${
-      cves.length ? this.renderCveList(cves) : '<p class="updater-detail-empty">No known CVEs. 🎉</p>'}</div>`;
+      cves.length ? `<div class="updater-cve-box">${this.renderCveList(cves)}</div>` : '<p class="updater-detail-empty">No known CVEs. 🎉</p>'}</div>`;
 
     // A rollback target exists if a snapshot field is present (future-proofing)
     // OR — the data the generator actually emits today — this app has a prior