diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 176d43abf6..97b00275c2 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -25,16 +25,4 @@ ignore = [
   #
   # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
   "RUSTSEC-2024-0436",
-  # `quick-xml` < 0.41.0 has quadratic duplicate-attribute validation and
-  # unbounded namespace-declaration allocation (parser DoS).
-  #
-  # It is transitive through object_store 0.13.2 (DataFusion 53 / Parquet 58),
-  # OpenDAL 0.57.0, and reqsign-aws-v4 3.0.0. Their released compatible
-  # versions cannot select the fixed quick-xml >=0.41.0 release.
-  #
-  # Per SECURITY-THREAT-MODEL.md, malformed-input parser CPU/memory DoS is
-  # hardening rather than an Iceberg Rust trust-boundary vulnerability. Remove
-  # once the transitive dependency set permits quick-xml >=0.41.0.
-  "RUSTSEC-2026-0194",
-  "RUSTSEC-2026-0195",
 ]
diff --git a/deny.toml b/deny.toml
index 27c3339ce3..f50c47815b 100644
--- a/deny.toml
+++ b/deny.toml
@@ -29,6 +29,7 @@ allow = [
   "ISC",
   "CC0-1.0",
   "Zlib",
+  # Category-A: https://issues.apache.org/jira/browse/LEGAL-732
   "CDLA-Permissive-2.0",
   # Category-A: https://issues.apache.org/jira/browse/LEGAL-660
   "Unicode-3.0",