diff --git a/Cargo.lock b/Cargo.lock
index 0f311cf..f09aed2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -381,9 +381,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
diff --git a/deny.toml b/deny.toml
index d4e4804..4433874 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,12 +15,6 @@ ignore = [
     # spin 0.9.8 is yanked but pulled in transitively via flume -> sqlx-sqlite;
     # we don't control the version and there is no non-yanked 0.9.x to move to.
     "spin@0.9.8",
-    # chacha20 0.10.1 was yanked upstream (not an advisory); it is pulled in
-    # transitively via rand. 0.10.0 is yanked too, so the only non-yanked
-    # stable release is 0.10.2, published 2026-08-27 — too new to adopt under
-    # the 7-day hold on fresh releases, which clears on 2026-09-03. Remove
-    # this then; see #162.
-    "chacha20@0.10.1",
 ]
 
 [licenses]
diff --git a/e2e/Cargo.lock b/e2e/Cargo.lock
index af32937..5bcbe1d 100644
--- a/e2e/Cargo.lock
+++ b/e2e/Cargo.lock
@@ -281,9 +281,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",