diff --git a/.github/workflows/rs_ci.yml b/.github/workflows/rs_ci.yml
index 5459220fb..63e791af8 100644
--- a/.github/workflows/rs_ci.yml
+++ b/.github/workflows/rs_ci.yml
@@ -190,7 +190,7 @@ jobs:
           working-directory: bottlecap
           # Mirrors bottlecap/.cargo/audit.toml. This action only reads ./.cargo/audit.toml
           # relative to its cwd (repo root), so the crate-local ignore list is never loaded in CI.
-          ignore: RUSTSEC-2026-0285
+          ignore: RUSTSEC-2026-0285,RUSTSEC-2026-0346,RUSTSEC-2026-0348,RUSTSEC-2026-0349
 
   cargo-lockfile-scan:
     name: Lockfile Scan
diff --git a/bottlecap/.cargo/audit.toml b/bottlecap/.cargo/audit.toml
index 016965b0f..f37b4a71d 100644
--- a/bottlecap/.cargo/audit.toml
+++ b/bottlecap/.cargo/audit.toml
@@ -1,7 +1,12 @@
-# RUSTSEC-2026-0285 is fixed in rustls >= 0.23.45, but that version requires
-# aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3
-# certification. Remove this ignore once a FIPS-certified aws-lc-rs is
-# available. Trivy reports the same advisory as GHSA-2mjx-qc3c-rqvc, ignored in
-# .trivyignore.yaml.
+# These rustls advisories are fixed in rustls >= 0.23.45 (RUSTSEC-2026-0285) or
+# >= 0.23.46 (the other three), but those versions require aws-lc-rs >= 1.18,
+# which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Remove these
+# ignores once a FIPS-certified aws-lc-rs is available. Trivy reports
+# RUSTSEC-2026-0285 as GHSA-2mjx-qc3c-rqvc, ignored in .trivyignore.yaml.
 [advisories]
-ignore = ["RUSTSEC-2026-0285"]
+ignore = [
+    "RUSTSEC-2026-0285",
+    "RUSTSEC-2026-0346",
+    "RUSTSEC-2026-0348",
+    "RUSTSEC-2026-0349",
+]