diff --git a/.cargo/audit.toml b/.cargo/audit.toml
new file mode 100644
index 0000000..801169c
--- /dev/null
+++ b/.cargo/audit.toml
@@ -0,0 +1,14 @@
+# quick-xml is pulled in only through wayland-scanner's build-time Wayland XML
+# code generation path:
+#
+#   wayland-scanner v0.31.10 -> quick-xml v0.39.x
+#
+# The current wayland-scanner release requires quick-xml ^0.39, so it cannot
+# accept the fixed quick-xml >=0.41.0 line yet. This project does not parse
+# attacker-controlled XML at runtime through quick-xml. Remove these ignores as
+# soon as wayland-scanner or the wayland-* crates release a compatible fix.
+[advisories]
+ignore = [
+  "RUSTSEC-2026-0194",
+  "RUSTSEC-2026-0195",
+]
diff --git a/Cargo.lock b/Cargo.lock
index 83adb4c..f8a94a1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -94,9 +94,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arrayvec"