diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d392170f6a..8f922404ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -884,7 +884,13 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Dependency policy
-        run: cargo-deny check
+        run: |
+          cargo-deny check
+          cargo-deny --locked \
+            --manifest-path desktop/src-tauri/Cargo.toml \
+            --target aarch64-apple-darwin \
+            --exclude-dev \
+            check --config deny.toml advisories
 
   dead-token-guard:
     name: Dead Token Reference Guard
diff --git a/deny.toml b/deny.toml
index d3c5fcd4bc..4c50606dbf 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,4 +1,8 @@
 [advisories]
+# Vulnerabilities remain fatal. Limit no-fix unmaintained notices to direct
+# workspace dependencies so target-specific transitive notices stay visible
+# without masking actionable vulnerability results.
+unmaintained = "workspace"
 ignore = [
     # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant.
     # Will be resolved when nostr crate updates its dependencies.
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index 00d3fba3b5..c6a12fd047 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -6166,9 +6166,9 @@ dependencies = [
 
 [[package]]
 name = "nostr-relay-pool"
-version = "0.44.1"
+version = "0.44.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91b2c039df4f96c4bf7dae52a74fd5516ad6dda83a11c0c69dea91b5255a4f37"
+checksum = "fb94d61a467a869a6790b907838a9bea82c813d567d9fcbac995f207be8cee4b"
 dependencies = [
  "async-utility",
  "async-wsocket",