diff --git a/CHANGELOG.md b/CHANGELOG.md
index da0189e..5ee545e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to `coderisktools-scanner` are documented here.
 
 ## [Unreleased]
 
+## [3.1.2] — 2026-07-27
+
+### Fixed
+
+- fixed the default `vuln-db init-config` output so `vuln-db update --full --profile core` no longer enables the retired `https://osv.dev/vulns/all.jsonl` endpoint that returns HTTP 404;
+- records the current OSV full dump location (`https://osv-vulnerabilities.storage.googleapis.com/all.zip`) as disabled/adapter-required until ZIP full-dump ingestion and sufficient staging disk are explicitly supported;
+- keeps working bounded sources enabled so controlled Core update runs fail less noisily and do not mislabel partial imports as full OSV coverage.
+
 ## [3.1.1] — 2026-07-26
 
 ### Added
diff --git a/pyproject.toml b/pyproject.toml
index 0310e6b..0375d99 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coderisktools-scanner"
-version = "3.1.1"
+version = "3.1.2"
 description = "Local-first open-source scanner for secret-like values and risky configuration changes in code diffs."
 readme = "README.md"
 license = "MIT"
diff --git a/src/__init__.py b/src/__init__.py
index 13a485a..c4a3257 100644
--- a/src/__init__.py
+++ b/src/__init__.py
@@ -1,3 +1,3 @@
 """Secret/Config Diff Scanner — Local CLI tool for detecting secrets and risky config changes in diffs."""
 
-__version__ = "3.1.1"
+__version__ = "3.1.2"
diff --git a/src/vulnerability/update_config.py b/src/vulnerability/update_config.py
index af4d167..30d5fb7 100644
--- a/src/vulnerability/update_config.py
+++ b/src/vulnerability/update_config.py
@@ -42,12 +42,13 @@ def default_update_config() -> dict[str, Any]:
             },
             {
                 "source_id": "osv",
-                "format": "osv-jsonl",
-                "url": "https://osv.dev/vulns/all.jsonl",
-                "allowed_hosts": ["osv.dev"],
+                "format": "osv-zip",
+                "url": "https://osv-vulnerabilities.storage.googleapis.com/all.zip",
+                "allowed_hosts": ["osv-vulnerabilities.storage.googleapis.com"],
                 "terms": "verify-before-redistribution",
-                "enabled": True,
-                "adapter_status": "dedicated-streaming-adapter-required",
+                "enabled": False,
+                "adapter_status": "zip-adapter-required",
+                "disabled_reason": "OSV full dump is published as all.zip; enable only with explicit ZIP/full-dump adapter support and sufficient staging disk.",
             },
             {
                 "source_id": "cve-v5",
@@ -88,7 +89,7 @@ def default_update_config() -> dict[str, Any]:
         ],
         "notes": [
             "This is a bounded starter configuration, not a claim of global feed coverage.",
-            "OSV full-feed JSONL and provider-specific feeds require their dedicated adapters/configuration.",
+            "OSV full-feed all.zip and provider-specific feeds require their dedicated adapters/configuration.",
             "Verify source terms and live response shape before production activation.",
         ],
     }
diff --git a/tests/test_default_update_config.py b/tests/test_default_update_config.py
index 0a11245..339a1da 100644
--- a/tests/test_default_update_config.py
+++ b/tests/test_default_update_config.py
@@ -8,5 +8,15 @@ def test_active_sources_are_supported_and_extended_sources_are_explicitly_disabl
         sources = default_update_config()["sources"]
         active = {item["source_id"] for item in sources if item.get("enabled", True)}
         disabled = {item["source_id"] for item in sources if item.get("enabled") is False}
-        self.assertEqual(active, {"osv", "cisa-kev", "epss", "github-advisories"})
-        self.assertTrue({"nvd", "cve-v5", "debian-security", "ubuntu-security", "rustsec"} <= disabled)
+        self.assertEqual(active, {"cisa-kev", "epss", "github-advisories"})
+        self.assertTrue({"nvd", "osv", "cve-v5", "debian-security", "ubuntu-security", "rustsec"} <= disabled)
+
+    def test_osv_default_config_uses_current_dump_url_but_is_not_auto_enabled(self):
+        sources = {item["source_id"]: item for item in default_update_config()["sources"]}
+        osv = sources["osv"]
+        self.assertFalse(osv["enabled"])
+        self.assertEqual(osv["format"], "osv-zip")
+        self.assertEqual(osv["url"], "https://osv-vulnerabilities.storage.googleapis.com/all.zip")
+        self.assertEqual(osv["allowed_hosts"], ["osv-vulnerabilities.storage.googleapis.com"])
+        self.assertEqual(osv["adapter_status"], "zip-adapter-required")
+        self.assertIn("all.zip", osv["disabled_reason"])