diff --git a/Dockerfile b/Dockerfile
index 829dfde..c9b0633 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,10 @@ RUN apt-get update \
 
 # Zig 0.14.1 avoids the libc++-19 bindgen requirement that 0.15+ introduces.
 ARG ZIG_VERSION=0.14.1
-ARG ZIGBUILD_VERSION=0.22.3
+# 0.23.0 is the first release whose zigcc wrapper filters
+# `-Wl,--fix-cortex-a53-843419`, which rustc started passing for
+# aarch64-unknown-linux-musl in 1.98 and zig's linker rejects.
+ARG ZIGBUILD_VERSION=0.23.0
 RUN cargo install cargo-zigbuild --version "${ZIGBUILD_VERSION}" --locked
 RUN set -eux; \
     case "$(uname -m)" in \
diff --git a/deny.toml b/deny.toml
index 4433874..d4e4804 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,6 +15,12 @@ ignore = [
     # spin 0.9.8 is yanked but pulled in transitively via flume -> sqlx-sqlite;
     # we don't control the version and there is no non-yanked 0.9.x to move to.
     "spin@0.9.8",
+    # chacha20 0.10.1 was yanked upstream (not an advisory); it is pulled in
+    # transitively via rand. 0.10.0 is yanked too, so the only non-yanked
+    # stable release is 0.10.2, published 2026-08-27 — too new to adopt under
+    # the 7-day hold on fresh releases, which clears on 2026-09-03. Remove
+    # this then; see #162.
+    "chacha20@0.10.1",
 ]
 
 [licenses]