diff --git a/ci/dependency-policy.json b/ci/dependency-policy.json
index 4363ba1..b1ee9dc 100644
--- a/ci/dependency-policy.json
+++ b/ci/dependency-policy.json
@@ -57,7 +57,7 @@
     { "name": "nix", "versions": ["0.28.0", "0.31.3"], "reason": "Machine-address and operating-system reporting crates have not unified their Unix API generation." },
     { "name": "nom", "versions": ["7.1.3", "8.0.0"], "reason": "Skia bindgen tooling remains on nom 7 while the native WebRTC stack uses nom 8." },
     { "name": "r-efi", "versions": ["5.3.0", "6.0.0"], "reason": "The three resolved getrandom generations require two WASI EFI interface generations." },
-    { "name": "rand", "versions": ["0.9.5", "0.10.2"], "reason": "WebRTC protocol crates use rand 0.9 while target-specific dependencies have adopted rand 0.10." },
+    { "name": "rand", "versions": ["0.9.5", "0.10.2"], "reason": "WebRTC protocol crates use rand 0.9 while the pinned skia-rs geometry graph uses rand 0.10." },
     { "name": "rand_core", "versions": ["0.6.4", "0.9.5", "0.10.1"], "reason": "DTLS elliptic curves and the two resolved rand generations require distinct rand_core APIs." },
     { "name": "rustc-hash", "versions": ["1.1.0", "2.1.3"], "reason": "The pinned skia-rs shader parser remains on rustc-hash 1 while existing workspace parsers use version 2." },
     { "name": "sha2", "versions": ["0.10.9", "0.11.0"], "reason": "WebRTC crypto still requires SHA-2 0.10 while MetaCrate integrity code directly uses 0.11." },
diff --git a/ci/evidence/provenance-audit.json b/ci/evidence/provenance-audit.json
index fe229dc..25764f5 100644
--- a/ci/evidence/provenance-audit.json
+++ b/ci/evidence/provenance-audit.json
@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "recorded_unix_seconds": 1786614077,
+  "recorded_unix_seconds": 1786616382,
   "upstream_commit": "2aa70bb68513b39795da5d13c88f31b86e85a3ba",
   "material_count": 27,
   "generated_output_count": 8,
@@ -12,7 +12,7 @@
   "dependency_manifest_sha256": "5f80b45ab18a45365673b55b52d68318bc31f602ce2f6559f573027cc446c58e",
   "third_party_notices_sha256": "c4d381944a9b57277963d2a5ee4e23a9a064c2ba93a676a49e023931b53a71d6",
   "native_notices_sha256": "b417ee7bf6b748cc86839e5354753c0f8c1f8309d13c0fea379c77f602e69fc0",
-  "distribution_manifest_sha256": "c58a89ad662bf05dc9420f875204ca8ef20cc4a4aaf5c821a2c4622b9eaf122f",
+  "distribution_manifest_sha256": "3b5b9b4a765d181d5777c96e9e90e62d960da8bc3d51f0f03cebba548ad4df55",
   "unknown_materials": 0,
   "unknown_bundled_assets": 0,
   "status": "ok"
diff --git a/deny.toml b/deny.toml
index 57e576d..c08123c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,7 +15,9 @@ allow = [
     "Apache-2.0 WITH LLVM-exception",
     "BSD-2-Clause",
     "BSD-3-Clause",
+    "CC0-1.0",
     "ISC",
+    "IJG",
     "MIT",
     "Unicode-3.0",
     "Zlib",
@@ -39,7 +41,6 @@ allow = []
 allow-workspace = true
 deny = []
 skip = [
-    { crate = "bit-vec@0.8.0", reason = "Approved pinned skia-rs shader parser compatibility line" },
     { crate = "bitflags@1.3.2", reason = "Approved pinned pure-Rust PNG compatibility line" },
     { crate = "block-buffer@0.10.4", reason = "Approved RustCrypto digest 0.10 compatibility line" },
     { crate = "cfg_aliases@0.1.1", reason = "Approved older nix build-helper line" },
@@ -52,6 +53,7 @@ skip = [
     { crate = "hashbrown@0.16.1", reason = "Approved pinned skia-rs geometry compatibility line" },
     { crate = "nix@0.28.0", reason = "Approved machine-address Unix compatibility line" },
     { crate = "nom@7.1.3", reason = "Approved Skia bindgen parser compatibility line" },
+    { crate = "rand@0.9.5", reason = "Approved WebRTC protocol line alongside skia-rs geometry's rand 0.10" },
     { crate = "rand_core@0.6.4", reason = "Approved elliptic-curve random compatibility line" },
     { crate = "rand_core@0.9.5", reason = "Approved rand 0.9 compatibility line" },
     { crate = "rustc-hash@1.1.0", reason = "Approved pinned skia-rs shader parser compatibility line" },
diff --git a/release/DISTRIBUTION-MANIFEST.json b/release/DISTRIBUTION-MANIFEST.json
index afcf757..26af551 100644
--- a/release/DISTRIBUTION-MANIFEST.json
+++ b/release/DISTRIBUTION-MANIFEST.json
@@ -222,8 +222,8 @@
     },
     {
       "path": "ci/dependency-policy.json",
-      "bytes": 12019,
-      "sha256": "5d35e2940c22da4c7a488a4ace7dc55ab7293a8ea713b6d71a62d1d0af2ac9cb"
+      "bytes": 12016,
+      "sha256": "0eb5aa6608a0c20006e63629069d0df6fbb0128e22a16d4d974ccf6caf6a39a6"
     },
     {
       "path": "ci/evidence/api-audit.json",
@@ -1632,8 +1632,8 @@
     },
     {
       "path": "deny.toml",
-      "bytes": 3140,
-      "sha256": "aa3d63fd17c6647be6c4b2d6467ca6282de588a8253a9d6a938a432287a8f2eb"
+      "bytes": 3175,
+      "sha256": "a3cc66d2394eb4f24ffa8887cdf5b3d345616366e84a79761b032123c4e61353"
     },
     {
       "path": "docs/agent-manager.md",