diff --git a/src-tauri/deny.toml b/src-tauri/deny.toml
index 6aa153e..613b616 100644
--- a/src-tauri/deny.toml
+++ b/src-tauri/deny.toml
@@ -8,6 +8,7 @@ ignore = [
   # without upgrading upstream: uniffi 0.28 (through kv-ffi) and gtk-rs glib-macros 0.18 (Tauri on Linux).
   { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
   { id = "RUSTSEC-2024-0436", reason = "paste via uniffi 0.28 (proc-macro)" },
+  { id = "RUSTSEC-2026-0374", reason = "basic-toml (unmaintained, no known vulnerability) via askama_derive 0.12 in uniffi_bindgen 0.28: build-time code generation only" },
   { id = "RUSTSEC-2024-0370", reason = "proc-macro-error via glib-macros 0.18 / Tauri gtk stack (proc-macro)" },
   # zbus 5 sub-crates folded into zbus 6 (no vulnerability). Linux only: keyring's Secret Service store
   # (device key) still uses zbus 5; revisit when secret-service moves to zbus 6.