diff --git a/.cargo/audit.toml b/.cargo/audit.toml
new file mode 100644
index 00000000..7a4cd0b5
--- /dev/null
+++ b/.cargo/audit.toml
@@ -0,0 +1,15 @@
+[advisories]
+ignore = [
+    # paste unmaintained — transitive via azure_core 0.21.0 (latest available).
+    # No direct security impact; no upgrade path exists.
+    # keep warning "RUSTSEC-2024-0436",
+
+    # rand 0.7.3 unsound — transitive via http-types → azure_core 0.21.0.
+    # Only exploitable with a custom logger using rand::rng(); not applicable here.
+    "RUSTSEC-2026-0097",
+
+    # RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
+    # Not affected: This application uses HS256 for internal JWT signing and only performs
+    # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
+    "RUSTSEC-2023-0071",
+]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 553f064e..f70cd45d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -136,13 +136,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      # RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
-      # Not affected: This application uses HS256 for internal JWT signing and only performs
-      # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
       - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          ignore: RUSTSEC-2023-0071
 
   build:
     name: Build Check
diff --git a/.gitignore b/.gitignore
index fdddd636..b9fb6993 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,9 +20,10 @@
 *.su
 *.idb
 
-# Build cache (keep .cargo/config.toml for project build settings)
+# Build cache (keep .cargo/config.toml for project build settings, keep audit config)
 .cargo/*
 !.cargo/config.toml
+!.cargo/audit.toml
 
 # temporary file to tools
 tmp/
diff --git a/justfile b/justfile
index 3a86ff53..f5cee183 100644
--- a/justfile
+++ b/justfile
@@ -39,7 +39,7 @@ check:
 
 # audit security (condition: cargo install cargo-audit)
 audit:
-    cargo audit --ignore RUSTSEC-2023-0071
+    cargo audit
 
 openapi:
     cargo run --bin generate-openapi