diff --git a/Cargo.lock b/Cargo.lock
index 01946da..2c6e9eb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -246,9 +246,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -364,15 +364,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -631,11 +622,10 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
  "parking",
  "pin-project-lite",
 ]
diff --git a/deny.toml b/deny.toml
index cd816e7..c902104 100644
--- a/deny.toml
+++ b/deny.toml
@@ -9,16 +9,9 @@ all-features = true
 [advisories]
 version = 2
 # Deny crates with a known security advisory (RUSTSEC) or that have been yanked.
-# `ignore` holds advisory IDs, and yanked-crate specs, we've reviewed and
-# consciously accept.
+# `ignore` holds advisory IDs we've reviewed and consciously accept.
 yanked = "deny"
-ignore = [
-    # chacha20 0.10.0 was yanked upstream; the unyanked 0.10.2 landed
-    # 2026-08-27 and is still inside the 7-day publish cooldown. Reached only
-    # transitively via rand -> sqlx-postgres, and the yank is not a security
-    # advisory. Drop this entry and `cargo update -p chacha20` from 2026-09-03.
-    { crate = "chacha20@0.10.0", reason = "yanked upstream; 0.10.2 still in publish cooldown" },
-]
+ignore = []
 
 [licenses]
 version = 2