diff --git a/src/output/multi-folder-html-reporter.ts b/src/output/multi-folder-html-reporter.ts
index 7432d0b3..d322af7d 100644
--- a/src/output/multi-folder-html-reporter.ts
+++ b/src/output/multi-folder-html-reporter.ts
@@ -12,9 +12,63 @@ import {
   serializeHtmlFinding,
 } from "./html-reporter.js";
 import type { SerializedFinding } from "./html-reporter.js";
+import { renderOverrideFindingsHtml } from "./override-findings-html.js";
+import { renderMaintenanceFindingsHtml } from "./maintenance-findings-html.js";
 import { loadLogoDataUri } from "./logos.js";
 import { pluralize } from "../utils/string.js";
 import type { SeverityLabel } from "../types.js";
+import type { OverrideFinding } from "../overrides/types.js";
+import type { MaintenanceFinding } from "../maintenance/types.js";
+
+export type MultiFolderReportData = {
+  multiFolder: true;
+  projectPath: string;
+  scannedAt: string;
+  cliVersion: string;
+  folders: string[];
+  findings: Array<SerializedFinding & { subfolder: string }>;
+  overrideFindings?: Array<OverrideFinding & { subfolder: string }>;
+  maintenanceFindings?: Array<MaintenanceFinding & { subfolder: string }>;
+};
+
+export function buildMultiFolderReportData(params: {
+  results: MultiFolderScanResult[];
+  serializedByFolder: SerializedFinding[][];
+  projectPath: string;
+  cliVersion: string;
+  includeOverrides?: boolean;
+  includeMaintenance?: boolean;
+}): MultiFolderReportData {
+  const findings = params.results.flatMap((r, i) =>
+    params.serializedByFolder[i].map(f => ({
+      ...f,
+      subfolder: r.subfolder,
+    })),
+  );
+
+  return {
+    multiFolder: true,
+    projectPath: params.projectPath,
+    scannedAt: new Date().toISOString(),
+    cliVersion: params.cliVersion,
+    folders: params.results.map(r => r.subfolder),
+    findings,
+    ...(params.includeOverrides
+      ? {
+          overrideFindings: params.results.flatMap(r =>
+            r.overrideFindings.map(f => ({ ...f, subfolder: r.subfolder })),
+          ),
+        }
+      : {}),
+    ...(params.includeMaintenance
+      ? {
+          maintenanceFindings: params.results.flatMap(r =>
+            r.maintenanceFindings.map(f => ({ ...f, subfolder: r.subfolder })),
+          ),
+        }
+      : {}),
+  };
+}
 
 type SevCounts = Record<SeverityLabel, number>;
 
@@ -43,6 +97,9 @@ function renderFolderSection(
   folderIdx: number,
   idxOffset: number,
   serialized: SerializedFinding[],
+  projectRoot: string,
+  includeOverrides?: boolean,
+  includeMaintenance?: boolean,
 ): string {
   const counts = { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 };
   for (const f of result.sorted) {
@@ -62,6 +119,13 @@ function renderFolderSection(
   const fixPlanHtml = renderFixPlan(result.suggestedFixCommands);
   const noticesHtml = renderFolderNotices(result.coverage);
   const completenessBannerHtml = renderCompletenessBanner(result.completeness);
+  const folderAbs = path.join(projectRoot, result.subfolder);
+  const overrideHtml = includeOverrides
+    ? renderOverrideFindingsHtml(result.overrideFindings, folderAbs)
+    : "";
+  const maintenanceHtml = includeMaintenance
+    ? renderMaintenanceFindingsHtml(result.maintenanceFindings)
+    : "";
 
   const emptyRow = result.sorted.length === 0
     ? `<tr><td colspan="6" style="text-align:center;padding:24px;color:#8b949e">No findings</td></tr>`
@@ -111,6 +175,8 @@ function renderFolderSection(
         </tbody>
       </table>
     </div>
+    ${overrideHtml}
+    ${maintenanceHtml}
   </div>
 </details>`;
 }
@@ -121,6 +187,10 @@ export async function writeMultiFolderHtmlReport(params: {
   projectPath: string;
   cliVersion: string;
   autoOpen: boolean;
+  /** When true, render override hygiene panels (even if empty). */
+  includeOverrides?: boolean;
+  /** When true, render maintenance risk panels (even if empty). */
+  includeMaintenance?: boolean;
 }): Promise<{ reportPath: string }> {
   fs.mkdirSync(params.outputDir, { recursive: true });
 
@@ -142,6 +212,15 @@ export async function writeMultiFolderHtmlReport(params: {
     r.sorted.map(f => serializeHtmlFinding(f, r.suggestedFixCommands)),
   );
 
+  const reportData = buildMultiFolderReportData({
+    results: params.results,
+    serializedByFolder: allSerialized,
+    projectPath: params.projectPath,
+    cliVersion: params.cliVersion,
+    includeOverrides: params.includeOverrides,
+    includeMaintenance: params.includeMaintenance,
+  });
+
   // Compact per-folder findings for JavaScript (only fields needed for filter/sort/search)
   const folderFindingsJson = JSON.stringify(
     allSerialized.map(findings =>
@@ -162,7 +241,15 @@ export async function writeMultiFolderHtmlReport(params: {
   let idxOffset = 0;
   const folderSectionsHtml = params.results
     .map((r, fi) => {
-      const html = renderFolderSection(r, fi, idxOffset, allSerialized[fi]);
+      const html = renderFolderSection(
+        r,
+        fi,
+        idxOffset,
+        allSerialized[fi],
+        params.projectPath,
+        params.includeOverrides,
+        params.includeMaintenance,
+      );
       idxOffset += r.sorted.length;
       return html;
     })
@@ -188,6 +275,7 @@ details[open] > .folder-summary .chevron{transform:rotate(90deg)}
 .folder-counts{font-size:11px;color:#8b949e;margin-left:auto}
 .folder-body{padding:0}
 .folder-body .fix-plan{margin:24px 32px 0}
+.folder-body .override-hygiene,.folder-body .maintenance-risk{margin:0 32px 24px}
 </style>
 </head>
 <body>
@@ -370,6 +458,8 @@ document.addEventListener('click', function(e) {
 </html>`;
 
   const indexPath = path.join(params.outputDir, "index.html");
+  const jsonPath = path.join(params.outputDir, "report.json");
+  fs.writeFileSync(jsonPath, JSON.stringify(reportData, null, 2), "utf8");
   fs.writeFileSync(indexPath, html, "utf8");
 
   if (params.autoOpen) openInBrowser(indexPath);
diff --git a/src/scan/multi-folder-scan.ts b/src/scan/multi-folder-scan.ts
index b4e79d9d..2ad2cded 100644
--- a/src/scan/multi-folder-scan.ts
+++ b/src/scan/multi-folder-scan.ts
@@ -351,6 +351,10 @@ export async function handleMultiFolderScan(params: {
       projectPath: params.projectRoot,
       cliVersion,
       autoOpen: !params.options.noOpen,
+      // Same undefined-vs-[] contract as single-folder buildReportData: pass the
+      // flag so empty panels render when the check ran with no hits.
+      includeOverrides: !!params.options.checkOverrides,
+      includeMaintenance: !!params.options.checkMaintenance,
     });
     console.log(`${chalk.gray("Report:")} ${chalk.cyan(reportPath)}`);
   }
diff --git a/tests/multi-folder-html-reporter.test.ts b/tests/multi-folder-html-reporter.test.ts
index f4cc1a33..81bcd038 100644
--- a/tests/multi-folder-html-reporter.test.ts
+++ b/tests/multi-folder-html-reporter.test.ts
@@ -1,10 +1,17 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { afterEach, describe, expect, it } from "@jest/globals";
-import { writeMultiFolderHtmlReport } from "../src/output/multi-folder-html-reporter.js";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+import { serializeHtmlFinding } from "../src/output/html-reporter.js";
+import {
+  buildMultiFolderReportData,
+  writeMultiFolderHtmlReport,
+} from "../src/output/multi-folder-html-reporter.js";
+import type { SerializedFinding } from "../src/output/html-reporter.js";
 import type { MultiFolderScanResult } from "../src/scan/multi-folder-scan.js";
-import type { ScanCompleteness } from "../src/types.js";
+import type { Finding, ScanCompleteness } from "../src/types.js";
+import type { OverrideFinding } from "../src/overrides/types.js";
+import type { MaintenanceFinding } from "../src/maintenance/types.js";
 
 const tempDirs: string[] = [];
 
@@ -14,28 +21,65 @@ afterEach(() => {
   }
 });
 
-function makeResult(subfolder: string, completeness: ScanCompleteness): MultiFolderScanResult {
+function makeFinding(name = "lodash"): Finding {
+  return {
+    pkg: { name, version: "4.17.20", ecosystem: "npm" },
+    vulnerabilities: [{ id: "GHSA-xxx", aliases: ["CVE-2021-23337"], summary: "test" }],
+    severity: "high",
+    cveAliases: ["CVE-2021-23337"],
+    dependencyPaths: [["project", name]],
+    relationship: "direct",
+    firstFixedVersion: "4.17.21",
+  };
+}
+
+function makeOverride(): OverrideFinding {
+  return {
+    ruleId: "OA001",
+    severity: "high",
+    package: { name: "gone" },
+    location: { file: "package.json", jsonPath: "/overrides/gone" },
+    message: "Override target not in resolved tree",
+  };
+}
+
+function makeMaintenance(): MaintenanceFinding {
+  return {
+    ruleId: "DM001",
+    severity: "high",
+    package: { name: "gray-matter", version: "4.0.3" },
+    drag: [],
+    message: "maintenance risk",
+  };
+}
+
+function makeResult(
+  subfolder: string,
+  overrides: Partial<MultiFolderScanResult> = {},
+): MultiFolderScanResult {
+  const completeness: ScanCompleteness = overrides.completeness ?? { complete: true, diagnostics: [] };
   return {
     subfolder,
     scanInput: {
       mode: "resolved-lockfile",
       source: "package-lock",
       filePath: `/project/${subfolder}/package-lock.json`,
-      packages: [],
+      packages: [{ name: "lodash", version: "4.17.20", ecosystem: "npm" }],
       notes: [],
       warnings: [],
       skippedDependencies: [],
     },
-    sorted: [],
+    sorted: [makeFinding()],
     suggestedFixCommands: null,
     coverage: [],
     minSeverity: "medium",
-    tableFindings: [],
-    allPackages: [],
+    tableFindings: [makeFinding()],
+    allPackages: [{ name: "lodash", version: "4.17.20", ecosystem: "npm" }],
     completeness,
     overrideFindings: [],
     maintenanceFindings: [],
     suppressedCount: 0,
+    ...overrides,
   };
 }
 
@@ -53,24 +97,32 @@ describe("multi-folder completeness HTML", () => {
       autoOpen: false,
       results: [
         makeResult("api", {
-          complete: false,
-          diagnostics: [{
-            code: "OSV_DETAIL_TRANSIENT_FAILURE",
-            severity: "warning",
-            message: detectionMessage,
-            impact: "detection",
-            count: 1,
-          }],
+          sorted: [],
+          tableFindings: [],
+          completeness: {
+            complete: false,
+            diagnostics: [{
+              code: "OSV_DETAIL_TRANSIENT_FAILURE",
+              severity: "warning",
+              message: detectionMessage,
+              impact: "detection",
+              count: 1,
+            }],
+          },
         }),
         makeResult("web", {
-          complete: false,
-          diagnostics: [{
-            code: "PACKUMENT_FETCH_FAILURE",
-            severity: "warning",
-            message: remediationMessage,
-            impact: "remediation",
-            count: 1,
-          }],
+          sorted: [],
+          tableFindings: [],
+          completeness: {
+            complete: false,
+            diagnostics: [{
+              code: "PACKUMENT_FETCH_FAILURE",
+              severity: "warning",
+              message: remediationMessage,
+              impact: "remediation",
+              count: 1,
+            }],
+          },
         }),
       ],
     });
@@ -94,3 +146,160 @@ describe("multi-folder completeness HTML", () => {
     expect(html).not.toContain('<li class="diag-item warning detection"><script>');
   });
 });
+
+function serializeResults(results: MultiFolderScanResult[]): SerializedFinding[][] {
+  return results.map(r => r.sorted.map(f => serializeHtmlFinding(f, r.suggestedFixCommands)));
+}
+
+describe("buildMultiFolderReportData", () => {
+  it("always includes multiFolder findings tagged by subfolder", () => {
+    const results = [makeResult("packages/a"), makeResult("packages/b")];
+    const data = buildMultiFolderReportData({
+      results,
+      serializedByFolder: serializeResults(results),
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+    });
+
+    expect(data.multiFolder).toBe(true);
+    expect(data.folders).toEqual(["packages/a", "packages/b"]);
+    expect(data.findings).toHaveLength(2);
+    expect(data.findings[0].subfolder).toBe("packages/a");
+    expect(data.overrideFindings).toBeUndefined();
+    expect(data.maintenanceFindings).toBeUndefined();
+  });
+
+  it("includes overrideFindings only when includeOverrides is set", () => {
+    const results = [makeResult("packages/a", { overrideFindings: [makeOverride()] })];
+    const data = buildMultiFolderReportData({
+      results,
+      serializedByFolder: serializeResults(results),
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+      includeOverrides: true,
+    });
+
+    expect(data.overrideFindings).toHaveLength(1);
+    expect(data.overrideFindings![0].subfolder).toBe("packages/a");
+    expect(data.overrideFindings![0].ruleId).toBe("OA001");
+  });
+
+  it("includes maintenanceFindings only when includeMaintenance is set", () => {
+    const results = [makeResult("packages/a", { maintenanceFindings: [makeMaintenance()] })];
+    const data = buildMultiFolderReportData({
+      results,
+      serializedByFolder: serializeResults(results),
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+      includeMaintenance: true,
+    });
+
+    expect(data.maintenanceFindings).toHaveLength(1);
+    expect(data.maintenanceFindings![0].subfolder).toBe("packages/a");
+    expect(data.maintenanceFindings![0].ruleId).toBe("DM001");
+  });
+});
+
+describe("writeMultiFolderHtmlReport", () => {
+  let outputDir: string;
+
+  beforeEach(() => {
+    outputDir = fs.mkdtempSync(path.join(os.tmpdir(), "cve-lite-mf-report-"));
+    tempDirs.push(outputDir);
+  });
+
+  it("writes both index.html and report.json", async () => {
+    await writeMultiFolderHtmlReport({
+      outputDir,
+      results: [makeResult("packages/a")],
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+      autoOpen: false,
+    });
+
+    expect(fs.existsSync(path.join(outputDir, "index.html"))).toBe(true);
+    expect(fs.existsSync(path.join(outputDir, "report.json"))).toBe(true);
+  });
+
+  it("report.json matches MultiFolderReportData shape", async () => {
+    await writeMultiFolderHtmlReport({
+      outputDir,
+      results: [makeResult("packages/a"), makeResult("packages/b")],
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+      autoOpen: false,
+    });
+
+    const json = JSON.parse(fs.readFileSync(path.join(outputDir, "report.json"), "utf8"));
+    expect(json.multiFolder).toBe(true);
+    expect(json.folders).toEqual(["packages/a", "packages/b"]);
+    expect(json.findings).toHaveLength(2);
+    expect(json.cliVersion).toBe("1.27.0");
+    expect(json.overrideFindings).toBeUndefined();
+  });
+
+  it("renders override and maintenance panels when flags are set", async () => {
+    await writeMultiFolderHtmlReport({
+      outputDir,
+      results: [
+        makeResult("packages/a", {
+          overrideFindings: [makeOverride()],
+          maintenanceFindings: [makeMaintenance()],
+        }),
+      ],
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+      autoOpen: false,
+      includeOverrides: true,
+      includeMaintenance: true,
+    });
+
+    const html = fs.readFileSync(path.join(outputDir, "index.html"), "utf8");
+    expect(html).toMatch(/Override hygiene/i);
+    expect(html).toContain("OA001");
+    expect(html).toMatch(/Maintenance risk/i);
+    expect(html).toContain("DM001");
+
+    const json = JSON.parse(fs.readFileSync(path.join(outputDir, "report.json"), "utf8"));
+    expect(json.overrideFindings).toHaveLength(1);
+    expect(json.maintenanceFindings).toHaveLength(1);
+  });
+
+  it("omits override/maintenance panels when flags are off", async () => {
+    await writeMultiFolderHtmlReport({
+      outputDir,
+      results: [
+        makeResult("packages/a", {
+          overrideFindings: [makeOverride()],
+          maintenanceFindings: [makeMaintenance()],
+        }),
+      ],
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+      autoOpen: false,
+    });
+
+    const html = fs.readFileSync(path.join(outputDir, "index.html"), "utf8");
+    expect(html).not.toMatch(/Override hygiene/i);
+    expect(html).not.toMatch(/Maintenance risk/i);
+
+    const json = JSON.parse(fs.readFileSync(path.join(outputDir, "report.json"), "utf8"));
+    expect(json.overrideFindings).toBeUndefined();
+    expect(json.maintenanceFindings).toBeUndefined();
+  });
+
+  it("renders empty override reassurance when includeOverrides is set with no findings", async () => {
+    await writeMultiFolderHtmlReport({
+      outputDir,
+      results: [makeResult("packages/a")],
+      projectPath: "/project",
+      cliVersion: "1.27.0",
+      autoOpen: false,
+      includeOverrides: true,
+    });
+
+    const html = fs.readFileSync(path.join(outputDir, "index.html"), "utf8");
+    expect(html).toMatch(/Override hygiene/i);
+    expect(html).toMatch(/No override hygiene findings/i);
+  });
+});
diff --git a/website/docs/html-report.md b/website/docs/html-report.md
index ca669f4a..0caab416 100644
--- a/website/docs/html-report.md
+++ b/website/docs/html-report.md
@@ -32,6 +32,8 @@ The report writes two files to the output directory:
 
 Running `--report` to the same directory a second time overwrites both files.
 
+In multi-folder mode (no root lockfile, two or more nested lockfiles), the report is the same two-file shape. Override hygiene and maintenance-risk panels appear per folder when `--check-overrides` / `--check-maintenance` were set, and `report.json` includes those findings tagged with `subfolder`.
+
 ## What the report shows
 
 **Severity summary cards** at the top give an immediate count for Critical, High, Medium, and Low findings alongside a total.