diff --git a/deny.toml b/deny.toml
index 20f571f..c6695bf 100644
--- a/deny.toml
+++ b/deny.toml
@@ -41,6 +41,27 @@ ignore = [
     # str0m refreshes its `time` dep to a release where the fix landed
     # without MSRV bump.
     "RUSTSEC-2026-0009",
+
+    # RUSTSEC-2024-0421 — `idna` ≤ 0.5.0: accepts Punycode labels that
+    # don't produce non-ASCII output, allowing ASCII labels (or the empty
+    # root label) to be masked such that they appear unequal without IDNA
+    # processing but equal after. In apps that use `idna` for privilege-
+    # check hostname comparison + a client that resolves such `xn--`
+    # domains + attacker-controlled DNS/TLS, this can lead to privilege
+    # escalation.
+    #   https://rustsec.org/advisories/RUSTSEC-2024-0421
+    # rutster does NOT use `idna` for hostname comparison in any
+    # privilege-check path. `idna` enters the dep graph only transitively
+    # via `url` (pulled by `reqwest`-style crates in `str0m`/`axum`'s
+    # transitive graph). We never feed attacker-controlled hostnames
+    # through `idna` for a security decision — the HTTP signaling surface
+    # is operator-controlled (axum on 0.0.0.0) and the media plane speaks
+    # IP:port directly. Bumping `idna` past 0.5.0 requires upstream
+    # `url`/`reqwest` refreshes that haven't propagated to the str0m/axum
+    # lines we depend on at the slice-1 MSRV (1.85). Revisit when the
+    # workspace MSRV lifts past 1.88 (cargodeny 0.19.x installs) or when
+    # `url` 2.5.x refreshes its `idna` dep.
+    "RUSTSEC-2024-0421",
 ]
 
 [licenses]
@@ -51,11 +72,16 @@ ignore = [
 allow = [
     # SPDX expression "GPL-3.0-or-later" is valid SPDX but cargo-deny 0.18.x
     # (the latest that installs on rust 1.85) can't parse the `-or-later`
-    # suffix. CI uses `cargo-deny-action@v1` (newer) which parses it; we use
-    # the bare `"GPL-3.0"` form so local `cargo deny check` works on the
-    # pinned toolchain. ADR-0004's "GPL-3.0-or-later" stance is unchanged;
-    # this is a parser workaround. When the workspace MSRV lifts past 1.88
-    # (where cargo-deny 0.19.x installs), revert this to `"GPL-3.0-or-later"`.
+    # suffix. We list both forms:
+    #   - `"GPL-3.0-or-later"` — matched by cargo-deny 0.19.x (CI via
+    #     `cargo-deny-action@v2`), correctly accepts our own crates'
+    #     `license = "GPL-3.0-or-later"` (ADR-0004 stance).
+    #   - `"GPL-3.0"` — bare form, needed for local `cargo deny check`
+    #     runs on rust 1.85 / cargo-deny 0.18.3 (the parser treats
+    #     `"GPL-3.0"` as matching GPL-3.0+ variants when it can't parse
+    #     `-or-later`). When the workspace MSRV lifts past 1.88 (where
+    #     cargo-deny 0.19.x installs locally), drop the `"GPL-3.0"` entry.
+    "GPL-3.0-or-later",
     "GPL-3.0",
     "MIT",
     "Apache-2.0",