diff --git a/deny.toml b/deny.toml
index 527e66c..8c03562 100644
--- a/deny.toml
+++ b/deny.toml
@@ -8,6 +8,7 @@ ignore = [
   # which regenerates the Swift/Kotlin bindings (tracked in fuzz/README.md "Dependency policy").
   { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
   { id = "RUSTSEC-2024-0436", reason = "paste via uniffi_core/uniffi_bindgen 0.28 (proc-macro)" },
+  { id = "RUSTSEC-2026-0374", reason = "basic-toml (unmaintained, no known vulnerability) via askama_derive 0.12 in uniffi_bindgen 0.28: build-time code generation only" },
 ]
 
 [licenses]