diff --git a/Dockerfile b/Dockerfile
index c480a17..39e0237 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,10 @@ RUN apt-get update \
 
 # Zig 0.14.1 avoids the libc++-19 bindgen requirement that 0.15+ introduces.
 ARG ZIG_VERSION=0.14.1
-ARG ZIGBUILD_VERSION=0.22.3
+# 0.23.0 is the first release that drops `-Wl,--fix-cortex-a53-843419`, which
+# rustc emits for aarch64 since 1.98 (rust-lang/rust#155453) and zig's linker
+# rejects. Anything older fails the arm64 leg outright.
+ARG ZIGBUILD_VERSION=0.23.0
 RUN cargo install cargo-zigbuild --version "${ZIGBUILD_VERSION}" --locked
 RUN set -eux; \
     case "$(uname -m)" in \
diff --git a/deny.toml b/deny.toml
index 0427393..cd816e7 100644
--- a/deny.toml
+++ b/deny.toml
@@ -9,9 +9,15 @@ all-features = true
 [advisories]
 version = 2
 # Deny crates with a known security advisory (RUSTSEC) or that have been yanked.
-# `ignore` holds advisory IDs we've reviewed and consciously accept.
+# `ignore` holds advisory IDs, and yanked-crate specs, we've reviewed and
+# consciously accept.
 yanked = "deny"
 ignore = [
+    # chacha20 0.10.0 was yanked upstream; the unyanked 0.10.2 landed
+    # 2026-08-27 and is still inside the 7-day publish cooldown. Reached only
+    # transitively via rand -> sqlx-postgres, and the yank is not a security
+    # advisory. Drop this entry and `cargo update -p chacha20` from 2026-09-03.
+    { crate = "chacha20@0.10.0", reason = "yanked upstream; 0.10.2 still in publish cooldown" },
 ]
 
 [licenses]