diff --git a/Cargo.lock b/Cargo.lock
index c291a58..f3ec0d9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1854,7 +1854,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5814,9 +5814,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.17"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "bytes",
  "getrandom 0.4.3",
@@ -5845,7 +5845,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6486,14 +6486,14 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "once_cell",
  "ring",
@@ -7418,10 +7418,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/Makefile b/Makefile
index 9c03cf7..bf5bcaf 100644
--- a/Makefile
+++ b/Makefile
@@ -114,8 +114,10 @@ geiger:
 	done
 
 ## Requires `cargo install cargo-audit`.
+## RUSTSEC-2026-0344: ruzstd via object 0.36 / aya; object >=0.40 needs aya bump.
 audit:
-	$(CARGO) audit
+	$(CARGO) audit \
+		--ignore RUSTSEC-2026-0344
 
 ## Requires `cargo install cargo-deny`.
 deny:
diff --git a/deny.toml b/deny.toml
index d9e07de..dc1bad5 100644
--- a/deny.toml
+++ b/deny.toml
@@ -8,6 +8,10 @@ all-features = false
 yanked = "warn"
 # Fail only if a direct workspace crate is unmaintained (GPUI pulls several).
 unmaintained = "workspace"
+ignore = [
+    # object 0.36 / aya-obj pin ruzstd 0.7; fixed line is ruzstd >= 0.9.1.
+    { id = "RUSTSEC-2026-0344", reason = "ruzstd 0.7 via object/aya-obj; no safe upgrade until aya bumps object" },
+]
 
 [licenses]
 unused-allowed-license = "allow"