diff --git a/web/src/components/ErrorBoundary.tsx b/web/src/components/ErrorBoundary.tsx
index 2f8334c..f8ee897 100644
--- a/web/src/components/ErrorBoundary.tsx
+++ b/web/src/components/ErrorBoundary.tsx
@@ -51,13 +51,18 @@ interface ErrorPayload {
  * Buildversion is injected by Vite at build time via define() —
  * falling back to 'dev' if missing means local dev doesn't fail to
  * compile.
+ *
+ * NOTE: the `declare const` MUST sit ABOVE its first use. JavaScript
+ * permits use-before-declare for `var` / function decls, but CodeQL's
+ * `js/use-before-declaration` rule flags it as a readability hazard
+ * (alert #37 on commit aa1c12a). We keep the symbol declared first.
  */
+declare const __APP_VERSION__: string;
+
 const BUILD_VERSION = (
   typeof __APP_VERSION__ !== 'undefined' ? __APP_VERSION__ : 'dev'
 );
 
-declare const __APP_VERSION__: string;
-
 /**
  * Optional Sentry-class endpoint. When set, the boundary POSTs the
  * error payload as JSON. Empty / unset = no telemetry (the safe