diff --git a/.cargo/audit.toml b/.cargo/audit.toml
new file mode 100644
index 0000000..4405873
--- /dev/null
+++ b/.cargo/audit.toml
@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: 2026 Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Configuration for `cargo audit` (Standard section 3.3).
+#
+# Entries here are ACCEPTED findings, not silenced ones: each carries the
+# reasoning that justified accepting it and the condition that would retire it.
+# Anything not listed is a genuine failure and must be fixed, not appended.
+
+[advisories]
+ignore = [
+    # RUSTSEC-2026-0002 — lru 0.12.5, reached only through ratatui 0.29.
+    #
+    # Severity INFO / unsound, not a vulnerability: `IterMut::next` and
+    # `next_back` briefly take an exclusive reference to the key, violating
+    # Stacked Borrows. There is no attacker-facing vector, and Vacuum is a
+    # local tool with no network surface (section 9, privacy-first).
+    #
+    # NOT REACHABLE FROM HERE. ratatui uses lru for exactly one thing, its
+    # layout memoisation cache — `LruCache<(Rect, Layout), (Segments, Spacers)>`
+    # in src/layout/layout.rs — and never calls `iter_mut` on it. Verified
+    # against the ratatui 0.29.0 sources, not assumed.
+    #
+    # NOT FIXABLE IN PLACE. ratatui 0.29 requires `lru = "0.12.0"`; the fix
+    # landed in lru 0.16.3, so no `cargo update` reaches it within semver. The
+    # only route is ratatui 0.30.x, which splits the crate into
+    # ratatui-core / -widgets / -crossterm and is a breaking port of
+    # vacuum-tui and vacuum-theme. Doing that hurriedly would trade a
+    # provably unreachable unsoundness for real instability, which Priority 1
+    # does not permit.
+    #
+    # RETIRE THIS ENTRY when Vacuum moves to ratatui 0.30. That release makes
+    # `layout-cache` an optional feature, so the migration can drop lru from
+    # the dependency tree outright rather than merely bumping it.
+    "RUSTSEC-2026-0002",
+]
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 0000000..ecc04db
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,41 @@
+# SPDX-FileCopyrightText: 2026 Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+name: audit
+
+# Deliberately NOT a pull-request gate. Advisories are published against
+# dependencies at arbitrary times, so running this per PR would redden a change
+# for a reason unrelated to it and train everyone to ignore a red tick. A
+# schedule reports the same information without blocking unrelated work
+# (Standard section 3.3 keeps `cargo audit` a pre-dependency-change step).
+on:
+  schedule:
+    # Mondays, 07:00 UTC. Times are UTC throughout (section 14).
+    - cron: "0 7 * * 1"
+  workflow_dispatch:
+  # Re-check whenever the dependency set or the accepted-findings list changes.
+  push:
+    branches: [main]
+    paths:
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "crates/*/Cargo.toml"
+      - ".cargo/audit.toml"
+
+jobs:
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        run: rustup toolchain install stable --profile minimal
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      # Accepted findings and the reasoning that justified them live in
+      # .cargo/audit.toml, which cargo-audit reads from the working directory.
+      - name: Audit
+        run: cargo audit
diff --git a/Cargo.lock b/Cargo.lock
index 3cce790..8343680 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -282,9 +282,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]