diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0267d2d..6611521 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -27,7 +27,7 @@ jobs:
       - run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.14.1
+        uses: pypa/gh-action-pypi-publish@v1.14.2
 
       - name: Create GitHub Release
         run: gh release create "$GITHUB_REF_NAME" --generate-notes
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index e75e539..4244ab9 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -48,9 +48,8 @@ jobs:
         run: pip install pip-audit
 
       - name: Audit dependencies
-        # `--ignore-vuln` allowlist mirrors `osv-scanner.toml` (e.g. PYSEC-2025-183;
-        # see that file for justifications). Keep both lists in sync.
+        # Any `--ignore-vuln` flag here mirrors `osv-scanner.toml`; keep both
+        # lists in sync, and drop an entry from both once it stops firing.
         run: |
           uv export --format requirements-txt --no-hashes > requirements.txt
-          pip-audit -r requirements.txt --disable-pip --no-deps \
-            --ignore-vuln PYSEC-2025-183
+          pip-audit -r requirements.txt --disable-pip --no-deps
diff --git a/osv-scanner.toml b/osv-scanner.toml
index d4453f5..36fa56d 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -11,15 +11,3 @@
 #     ignores (e.g. disputed-by-upstream). Otherwise pick a date that forces
 #     us to re-evaluate when the upstream releases a fix.
 #   - `reason` — short justification
-
-[[IgnoredVulns]]
-id = "PYSEC-2025-183"
-# pyjwt 2.10.1+ flagged for "weak encryption" — disputed by upstream pyjwt
-# maintainers ("the key length is chosen by the application that uses the
-# library"). No fixed version exists in the advisory. pyjwt is a transitive
-# of cdp-sdk (Coinbase) under the optional `coinbase` extra; merchants
-# install it only when wiring the x402 Coinbase facilitator, and the JWT
-# keys used in that path are user-provided. Library is library; the dispute
-# is justified for our usage. Re-evaluate if upstream releases a fix.
-ignoreUntil = "2027-01-01T00:00:00Z"
-reason = "Disputed by pyjwt maintainers; key-length is an application-layer concern; cdp-sdk's keys are user-provided"