diff --git a/targets.go b/targets.go
index cc09fdc..f055c76 100644
--- a/targets.go
+++ b/targets.go
@@ -53,6 +53,15 @@ func resolveScanRoots(target string) (backendDir string, repoRoot string, err er
 		return filepath.Join(absTarget, "backend"), absTarget, nil
 	}
 
+	// Consolidated CMS layout — Go module at backend/, frontend at web/src.
+	// The clause above keys on backend/cmd/check-safety, which left the CMS
+	// tree when check-safety was hoisted to its own repo; without this one
+	// the CMS resolves as its own backend, web/ is classified as a plugin
+	// frontend, and the strict plugin rules bypass allowedFrontendFiles.
+	if fileExists(filepath.Join(absTarget, "backend", "go.mod")) && dirExists(filepath.Join(absTarget, "web", "src")) {
+		return filepath.Join(absTarget, "backend"), absTarget, nil
+	}
+
 	if dirExists(filepath.Join(absTarget, "cmd", "check-safety")) {
 		parent := filepath.Clean(filepath.Join(absTarget, ".."))
 		if fileExists(filepath.Join(parent, "buf.yaml")) {