diff --git a/deny.toml b/deny.toml
index 1f9ddac..b08951c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -49,6 +49,7 @@ ignore = [
     { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained (superseded by rustls-pki-types); transitive via Helios + the Zed gpui fork" },
     { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 unmaintained; build-time proc-macro only, no runtime surface" },
     { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained; transitive via gpui (fontdb->usvg) runtime font/SVG glyph parsing; no maintained drop-in in the pinned tree; re-evaluate on just bump-gpui" },
+    { id = "RUSTSEC-2026-0206", reason = "rustybuzz unmaintained (superseded by harfrust); transitive via gpui (usvg/resvg) runtime SVG text shaping; usvg has no harfrust release yet, so no in-tree fix; re-evaluate on just bump-gpui (#221)" },
     # ── gtk-rs GTK3 bindings — unmaintained (the gtk3-rs project is EOL, superseded by gtk4-rs). Pulled
     #    ONLY by the optional `tray` feature (libappindicator → gtk3); not in the default build. The tray
     #    ecosystem (tray-icon/libappindicator) has no GTK4 path yet, so this rides until that lands.