diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 06fac0c8..73e413df 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -68,11 +68,19 @@ jobs:
           # Fail closed with licenses derived from the project's full dependency tree,
           # replacing the deprecated deny-licenses option.
           allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0
-          # Per-dependency exception to the allowlist above: sonarqube-scan-action
-          # (used in fork-sonar.yml) is LGPL-3.0. The action only executes the
-          # scanner on the runner — use of an unmodified tool, not distribution
-          # or a derivative work — so LGPL obligations do not apply. The purl is
-          # deliberately version-less: dependency-review-action's matcher ignores
-          # the version anyway, and it is the usage as a CI action that makes the
-          # license unproblematic, independent of the pinned revision.
-          allow-dependencies-licenses: 'pkg:githubactions/SonarSource/sonarqube-scan-action'
+          # Per-dependency exceptions to the allowlist above. Each flagged
+          # package is executed as an unmodified tool on the runner or the
+          # build machine — not distributed, not a derivative work — so its
+          # license imposes no obligations on the published artifacts:
+          #   - sonarqube-scan-action (fork-sonar.yml): LGPL-3.0 CI action.
+          #   - sonar-maven-plugin (pluginManagement): LGPL-3.0 build plugin.
+          #   - lombok (performance-test 'lombok' profile, provided scope):
+          #     MIT-licensed, but GitHub's licensee reports its LICENSE as
+          #     LicenseRef-bad-non-standard (NOASSERTION) — a misdetection.
+          # The purls are deliberately version-less: the matcher ignores the
+          # version anyway, and it is the usage that makes the licenses
+          # unproblematic, independent of the pinned revision.
+          allow-dependencies-licenses: >-
+            pkg:githubactions/SonarSource/sonarqube-scan-action,
+            pkg:maven/org.sonarsource.scanner.maven/sonar-maven-plugin,
+            pkg:maven/org.projectlombok/lombok