diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..fce8594
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,4 @@
+[advisories]
+ignore = [
+  { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 unmaintained, transitive via openmls_rust_crypto; no upgrade available" },
+]