diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index c73c70e39..0d1dde4a9 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -11,3 +11,9 @@ vulnerabilities:
       `tar` is a build dependency of `libddwaf-sys`, used by its build script.
       It is not linked into the extension binary: `cargo tree -i tar -e normal`
       reports nothing, while `-e build,normal` reports the build-script edge.
+  - id: GHSA-2mjx-qc3c-rqvc
+    statement: |
+      Same advisory as RUSTSEC-2026-0285, ignored for cargo-audit in
+      `bottlecap/.cargo/audit.toml`. The fix is in rustls >= 0.23.45, which
+      requires aws-lc-rs >= 1.18 and so AWS-LC-FIPS 4.x, pending FIPS 140-3
+      certification. Remove this entry together with that ignore.
diff --git a/bottlecap/.cargo/audit.toml b/bottlecap/.cargo/audit.toml
index 8e88df8d7..016965b0f 100644
--- a/bottlecap/.cargo/audit.toml
+++ b/bottlecap/.cargo/audit.toml
@@ -1,6 +1,7 @@
 # RUSTSEC-2026-0285 is fixed in rustls >= 0.23.45, but that version requires
 # aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3
 # certification. Remove this ignore once a FIPS-certified aws-lc-rs is
-# available.
+# available. Trivy reports the same advisory as GHSA-2mjx-qc3c-rqvc, ignored in
+# .trivyignore.yaml.
 [advisories]
 ignore = ["RUSTSEC-2026-0285"]