diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 34307d8af13..8808b599e62 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -58,5 +58,9 @@
     // pinned
     // only used in example for e2e tests
     'marked',
+
+    // pinned, 5.0+ has exports issues
+    // https://github.com/vuejs/core/issues/11603
+    'entities',
   ],
 }
diff --git a/packages/compiler-core/package.json b/packages/compiler-core/package.json
index 4172a3919f1..6acbf724c45 100644
--- a/packages/compiler-core/package.json
+++ b/packages/compiler-core/package.json
@@ -48,7 +48,7 @@
   "dependencies": {
     "@babel/parser": "catalog:",
     "@vue/shared": "workspace:*",
-    "entities": "^5.0.0",
+    "entities": "^4.5.0",
     "estree-walker": "catalog:",
     "source-map-js": "catalog:"
   },
diff --git a/packages/compiler-core/src/parser.ts b/packages/compiler-core/src/parser.ts
index 55487e12b70..cac943dd63d 100644
--- a/packages/compiler-core/src/parser.ts
+++ b/packages/compiler-core/src/parser.ts
@@ -44,7 +44,7 @@ import {
   isSimpleIdentifier,
   isStaticArgOf,
 } from './utils'
-import { decodeHTML } from 'entities/dist/decode.js'
+import { decodeHTML } from 'entities/lib/decode.js'
 import {
   type ParserOptions as BabelOptions,
   parse,
diff --git a/packages/compiler-core/src/tokenizer.ts b/packages/compiler-core/src/tokenizer.ts
index 7e93cdf5878..35c49fa6545 100644
--- a/packages/compiler-core/src/tokenizer.ts
+++ b/packages/compiler-core/src/tokenizer.ts
@@ -36,7 +36,7 @@ import {
   EntityDecoder,
   fromCodePoint,
   htmlDecodeTree,
-} from 'entities/dist/decode.js'
+} from 'entities/lib/decode.js'
 
 export enum ParseMode {
   BASE,
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2a4aeb62eb4..975f879b8e1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -256,8 +256,8 @@ importers:
         specifier: workspace:*
         version: link:../shared
       entities:
-        specifier: ^5.0.0
-        version: 5.0.0
+        specifier: ^4.5.0
+        version: 4.5.0
       estree-walker:
         specifier: 'catalog:'
         version: 2.0.2
@@ -1773,10 +1773,6 @@ packages:
     resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==}
     engines: {node: '>=0.12'}
 
-  entities@5.0.0:
-    resolution: {integrity: sha512-BeJFvFRJddxobhvEdm5GqHzRV/X+ACeuw0/BuuxsCh1EUZcAIz8+kYmBp/LrQuloy6K1f3a0M7+IhmZ7QnkISA==}
-    engines: {node: '>=0.12'}
-
   env-paths@2.2.1:
     resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==}
     engines: {node: '>=6'}
@@ -4700,8 +4696,6 @@ snapshots:
 
   entities@4.5.0: {}
 
-  entities@5.0.0: {}
-
   env-paths@2.2.1: {}
 
   environment@1.1.0: {}
diff --git a/rollup.config.js b/rollup.config.js
index 79883d1ddfd..a9f9b17f3df 100644
--- a/rollup.config.js
+++ b/rollup.config.js
@@ -258,7 +258,7 @@ function createConfig(format, output, plugins = []) {
       'source-map-js',
       '@babel/parser',
       'estree-walker',
-      'entities/dist/decode.js',
+      'entities/lib/decode.js',
     ]
 
     if (isGlobalBuild || isBrowserESMBuild || isCompatPackage) {