diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 39b3401..8245039 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -16,4 +16,8 @@ ignore = [
     # logger calls `rand::rng()` during reseeding. Our 0.8.5 (transitive via alloy-consensus)
     # has neither feature enabled; our 0.9.4 is already patched.
     "RUSTSEC-2026-0097",
+
+    # `rsa` Marvin Attack; transitive dep via `sqlx-macros-core` -> `sqlx-mysql`. The `mysql`
+    # feature is not enabled, so `sqlx-mysql` is never compiled — it only appears in Cargo.lock.
+    "RUSTSEC-2023-0071",
 ]