diff --git a/client/src-tauri/Cargo.toml b/client/src-tauri/Cargo.toml
index e55746a8..3237df03 100644
--- a/client/src-tauri/Cargo.toml
+++ b/client/src-tauri/Cargo.toml
@@ -71,9 +71,11 @@ nnnoiseless = { version = "0.5", default-features = false }
 # adapts the Linux backend to the new enum structure plus a Windows typo fix.
 #
 # Upstream tracking:
-# - CapSoftware/scap#178 — broader fix, open since 2025-10-26, no updates
-# - Last re-check 2026-04-12: upstream main HEAD still fails Linux build
-#   (see closed PR #520 for the test run)
+# - CapSoftware/scap#178 — broader fix, still open (last upstream update
+#   2025-10-26)
+# - Last re-check 2026-05-13: upstream latest release is still v0.1.0-beta.1
+#   (2025-08-04). No new releases or merged Linux Frame enum fixes.
+# - Previous re-check 2026-04-12: see closed PR #520 for the test run
 # - Issue #521 tracks periodic re-checks — drop this git dep when upstream
 #   publishes a new release with the Linux fix
 scap = { git = "https://github.com/Detair/scap.git", branch = "fix/linux-frame-enum" }
diff --git a/deny.toml b/deny.toml
index 329be5e6..bd297a76 100644
--- a/deny.toml
+++ b/deny.toml
@@ -14,15 +14,18 @@ unmaintained = "workspace"
 ignore = [
     # rsa crate Marvin Attack - no safe upgrade available, used by openidconnect
     "RUSTSEC-2023-0071",
-    # rand 0.8.5 unsoundness with custom `log` logger - not exploitable in Kaiku
-    # because we use `tracing`/`tracing-subscriber`, not the `log` facade.
-    # The exploitable configuration requires a `log::Log` implementation that
-    # calls `rand::thread_rng()` during logging, which does not exist in this
-    # codebase. Transitive deps (fred, jsonwebtoken, openidconnect, webrtc,
-    # sqlx-postgres, vodozemac, etc.) pin rand 0.8, so the crate will stay in
-    # the tree until upstreams migrate to 0.9. Bumping our direct deps to 0.9
-    # would not remove the transitive 0.8.5 and would require breaking API
-    # changes (thread_rng → rng, gen_range → random_range).
+    # rand unsoundness with custom `log` logger — flagged against rand 0.7.3,
+    # 0.8.5, 0.9.2, AND 0.10.0 (all versions; the underlying API contract
+    # hasn't changed). Not exploitable in Kaiku because we use `tracing` /
+    # `tracing-subscriber`, not the `log` facade. The exploitable
+    # configuration requires a `log::Log` implementation that calls
+    # `rand::thread_rng()` (or its v0.9+ equivalent `rand::rng()`) during
+    # logging, which does not exist in this codebase. Transitive deps (fred,
+    # jsonwebtoken, openidconnect, webrtc, sqlx-postgres, vodozemac, etc.)
+    # pin various rand majors across the tree; bumping our direct rand
+    # version wouldn't drop the transitive copies. The ignore stays
+    # version-agnostic because the rationale (no log facade in our code) is
+    # invariant across rand majors.
     "RUSTSEC-2026-0097",
 ]