diff --git a/CHANGELOG.md b/CHANGELOG.md
index adc5d0d..a756f3a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-Nothing yet.
+### Security
+
+- Bumped transitive `crossbeam-epoch` 0.9.18 -> 0.9.20 (lockfile-only) to
+  patch RUSTSEC-2026-0204: invalid pointer dereference in the
+  `fmt::Pointer`/`Display` impls for `Atomic`/`Shared` on null pointers.
+  Pulled in via the iggy SDK and `metrics-exporter-prometheus`; not used
+  directly by this crate.
 
 ## [0.3.0] - 2026-07-05
 
diff --git a/Cargo.lock b/Cargo.lock
index 5f908db..40c2748 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1125,9 +1125,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]