diff --git a/app/src/main/java/com/m57/hermescontrol/data/remote/ApiClient.kt b/app/src/main/java/com/m57/hermescontrol/data/remote/ApiClient.kt
index bf9283d1..19ea096a 100644
--- a/app/src/main/java/com/m57/hermescontrol/data/remote/ApiClient.kt
+++ b/app/src/main/java/com/m57/hermescontrol/data/remote/ApiClient.kt
@@ -2,6 +2,7 @@ package com.m57.hermescontrol.data.remote
 
 import com.m57.hermescontrol.BuildConfig
 import com.m57.hermescontrol.data.local.AuthManager
+import okhttp3.CertificatePinner
 import okhttp3.Interceptor
 import okhttp3.OkHttpClient
 import okhttp3.logging.HttpLoggingInterceptor
@@ -72,11 +73,17 @@ object ApiClient {
                 chain.proceed(request)
             }
 
+        // SEC-11: No certificate pinning is configured by default since the app
+        // intentionally uses HTTP for LAN and hosts are dynamic.
+        // CertificatePinner infrastructure is provided here if HTTPS is used with a known host.
+        val certificatePinner = CertificatePinner.Builder().build()
+
         val okHttp =
             OkHttpClient
                 .Builder()
                 .addInterceptor(authInterceptor)
                 .addInterceptor(logging)
+                .certificatePinner(certificatePinner)
                 .connectTimeout(15, TimeUnit.SECONDS)
                 .readTimeout(30, TimeUnit.SECONDS)
                 .writeTimeout(15, TimeUnit.SECONDS)
diff --git a/app/src/main/java/com/m57/hermescontrol/data/ws/HermesWsClient.kt b/app/src/main/java/com/m57/hermescontrol/data/ws/HermesWsClient.kt
index b48469a4..bf3effa2 100644
--- a/app/src/main/java/com/m57/hermescontrol/data/ws/HermesWsClient.kt
+++ b/app/src/main/java/com/m57/hermescontrol/data/ws/HermesWsClient.kt
@@ -17,6 +17,7 @@ import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asSharedFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
+import okhttp3.CertificatePinner
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.Response
@@ -74,9 +75,15 @@ object HermesWsClient {
     @Volatile
     private var reconnectJob: Job? = null
 
+    // SEC-11: No certificate pinning is configured by default since the app
+    // intentionally uses HTTP for LAN and hosts are dynamic.
+    // CertificatePinner infrastructure is provided here if HTTPS is used with a known host.
+    private val certificatePinner = CertificatePinner.Builder().build()
+
     private val okHttpClient =
         OkHttpClient
             .Builder()
+            .certificatePinner(certificatePinner)
             .readTimeout(0, TimeUnit.MILLISECONDS) // keep-alive forever
             .pingInterval(30, TimeUnit.SECONDS)
             .build()