diff --git a/Cargo.toml b/Cargo.toml
index 9262696..044cf5e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -89,6 +89,16 @@ rustls = { version = "0.23", default-features = false, features = ["aws-lc-rs",
 # (transitive once Task 1's Cargo.lock resolves). Used by the serve_tls integration
 # test's TLS client handshake.
 tokio-rustls = { version = "0.26", default-features = false, features = ["aws-lc-rs", "ring"] }
+# redis 1.3.0: Valkey/Redis client for ValkeyEventSink (deploy spec §5.6).
+# BSD-3-Clause (verified via docs.rs/redis/1.3.0 + crates.io API), cargo-deny clean against
+# the deny.toml allow list (line 88). Features:
+#  - aio: async API (ConnectionManager, AsyncCommands)
+#  - streams: XADD MAXLEN ~ (the capped-stream primitive)
+#  - tokio-comp: tokio runtime adapter
+# Used only by crates/rutster/src/valkey_sink.rs. default-features = false deliberately DROPS
+# the redis crate's TLS feature — TLS to Valkey is the operator's network posture
+# (ADR-0005 sub-ms rule), not a rutster code path.
+redis = { version = "1.3.0", default-features = false, features = ["aio", "streams", "tokio-comp"] }
 # rcgen NOTE: rcgen 0.14.8 bumped MSRV to Rust 1.88, breaking the 1.85
 # toolchain matrix. rcgen is a transitive dep via dimpl → str0m 0.21 →
 # rutster-media. Cargo.lock pins it to 0.14.7 (the minimum satisfying