diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 608cdd3a..17596a66 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -237,14 +237,21 @@ jobs:
       - name: Install pinned cargo-audit
         run: cargo install cargo-audit --locked --version 0.22.2
       - name: Audit the locked dependency graph
-        # These four advisories are unmaintained notices in optional/build or
-        # Slint/Blitz typography dependencies. Deny every new warning while the
-        # upstream replacements are tracked explicitly here.
+        # These advisories are maintenance notices, not vulnerability exceptions.
+        # The first four cover optional/build or Slint/Blitz typography crates.
+        # RUSTSEC-2026-0370/0371/0372 cover zvariant, zbus_names and zvariant_derive,
+        # merged into zbus 6: https://github.com/z-galaxy/zbus/issues/2043.
+        # Slint 1.18.1 (including ksni) and ashpd 0.11 (including rfd) still
+        # require zbus 5. Remove these three exceptions when those upstreams
+        # migrate. Continue denying every other warning and vulnerability.
         run: |
           for lockfile in Cargo.lock platform/android/Cargo.lock; do
             cargo audit --file "$lockfile" --deny warnings \
               --ignore RUSTSEC-2025-0141 \
               --ignore RUSTSEC-2024-0436 \
               --ignore RUSTSEC-2026-0206 \
-              --ignore RUSTSEC-2026-0192
+              --ignore RUSTSEC-2026-0192 \
+              --ignore RUSTSEC-2026-0370 \
+              --ignore RUSTSEC-2026-0371 \
+              --ignore RUSTSEC-2026-0372
           done
diff --git a/Cargo.lock b/Cargo.lock
index fd93ea10..58e5c47d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -70,9 +70,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "ammonia"
-version = "4.1.7"
+version = "4.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36322ccf536de7b7afd259098615203e4cc5caca1b78482b58334a720c66e40a"
+checksum = "2f6660fb4ff692ef4937b1b4e74ab3d378653d8588389587d91f96a296907ea0"
 dependencies = [
  "cssparser 0.37.0",
  "html5ever 0.39.0",
diff --git a/crates/flectar-mail-core/Cargo.toml b/crates/flectar-mail-core/Cargo.toml
index ebee648e..61abc6e0 100644
--- a/crates/flectar-mail-core/Cargo.toml
+++ b/crates/flectar-mail-core/Cargo.toml
@@ -76,7 +76,7 @@ quick-xml = { version = "0.42", features = ["encoding"] }
 async-trait = "0.1"
 
 # misc
-ammonia = "4"
+ammonia = "4.1.8"
 deunicode = "1"
 rand = "0.9"
 regex = "1"
diff --git a/platform/android/Cargo.lock b/platform/android/Cargo.lock
index 01f78309..c1c04561 100644
--- a/platform/android/Cargo.lock
+++ b/platform/android/Cargo.lock
@@ -70,9 +70,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "ammonia"
-version = "4.1.7"
+version = "4.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36322ccf536de7b7afd259098615203e4cc5caca1b78482b58334a720c66e40a"
+checksum = "2f6660fb4ff692ef4937b1b4e74ab3d378653d8588389587d91f96a296907ea0"
 dependencies = [
  "cssparser 0.37.0",
  "html5ever 0.39.0",