diff --git a/Cargo.lock b/Cargo.lock
index c31f2529158..020c0d562e3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1239,7 +1239,7 @@ dependencies = [
  "nix 0.31.3",
  "nostr 0.44.7",
  "reqwest 0.13.4",
- "rmcp 3.4.1",
+ "rmcp 3.9.0",
  "rustls",
  "schemars 1.2.1",
  "serde",
@@ -5602,7 +5602,7 @@ dependencies = [
  "rand 0.10.1",
  "regex-lite",
  "reqwest 0.13.4",
- "rmcp 3.4.1",
+ "rmcp 3.9.0",
  "rpassword",
  "rustls",
  "same-file",
@@ -5714,7 +5714,7 @@ dependencies = [
  "prost 0.14.3",
  "prost-build 0.14.3",
  "protoc-bin-vendored",
- "rmcp 3.4.1",
+ "rmcp 3.9.0",
  "schemars 1.2.1",
  "serde",
  "serde_json",
@@ -8707,9 +8707,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp"
-version = "3.4.1"
+version = "3.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b6317cd8c13e3ec9033cf2aa5aa92cd743f0f4f8a93cddc42ea0ae6ce3b8898"
+checksum = "d24a7e92f4bcaa36b97fa93c4fa7ca8f3e669eced949345b3462dba333c7f909"
 dependencies = [
  "async-trait",
  "base64 0.23.1",
@@ -8720,6 +8720,7 @@ dependencies = [
  "http-body",
  "http-body-util",
  "indexmap 2.14.0",
+ "libc",
  "pastey",
  "pin-project-lite",
  "process-wrap 10.0.1",
@@ -8729,6 +8730,7 @@ dependencies = [
  "schemars 1.2.1",
  "serde",
  "serde_json",
+ "sha2 0.11.0",
  "sse-stream",
  "thiserror 2.0.18",
  "tokio",
@@ -8741,9 +8743,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp-macros"
-version = "3.4.1"
+version = "3.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ee366004e5f87c103be91c6c09337811517ae8d2f919ece9da7c21444b85c5"
+checksum = "b3140f24a766f80f9ec1607bde85680959a69b83d46fa9ce87dadab7e67ab029"
 dependencies = [
  "darling 0.24.1",
  "proc-macro2",
diff --git a/deny.toml b/deny.toml
index 588d98ce0ef..2a5341f94b7 100644
--- a/deny.toml
+++ b/deny.toml
@@ -39,6 +39,23 @@ ignore = [
     # Keep the exact NetEQ pin and the wrapper ban below together. Re-audit or
     # remove this exception when NetEQ removes/updates the unused dependency.
     { id = "RUSTSEC-2026-0293", reason = "unused dependency of audited, exactly pinned neteq 0.8.3; no Rust references to ringbuf; other consumers forbidden by bans.deny" },
+    # rmcp < 3.9.0: the Streamable HTTP clients read non-streaming response bodies into memory with no size limit, so a
+    # malicious or compromised MCP server can exhaust the client's memory. The only patched range is >= 3.9.0; rmcp 1.x
+    # has no fix. rmcp 1.8.0 reaches us only via buzz-agent, which compiles just its client and transport-child-process
+    # features. The code the advisory names sits behind transport-streamable-http-client* and __reqwest, which are off,
+    # so the HTTP transport is not built. This id-level ignore would also hide a 3.x copy, so rmcp 3.x must stay at
+    # >= 3.9.0. Remove when buzz-agent moves to rmcp >= 3.9.
+    { id = "RUSTSEC-2026-0462", reason = "rmcp 1.8.0 via buzz-agent compiles only client and transport-child-process, so the affected HTTP client is not built; no 1.x fix; rmcp 3.x must stay >= 3.9.0" },
+    # libsqlite3-sys < 0.39 bundles SQLite < 3.54.0, which can return uninitialized page-cache memory when it opens a
+    # database with a sibling -wal file of a different page size (CVE-2026-119375): a crafted pair makes ordinary queries
+    # return stale bytes from the process's memory. No tagged upgrade resolves: the fix needs libsqlite3-sys >= 0.39 (rusqlite
+    # >= 0.41), mesh-llm-log-store requires rusqlite ^0.40 through mesh-llm v0.78.1, libsqlite3-sys's links = "sqlite3"
+    # allows one copy, and the patched sqlx-sqlite caps it below 0.39. The risk is accepted, not absent: the desktop opens
+    # archive/archive.db inside the nest at every start, and the nest is the working directory of spawned agents, so a
+    # sandboxed agent able to write there could plant the db and -wal pair. The app's other databases are outside the
+    # nest. Remove when libsqlite3-sys >= 0.39 resolves: that needs a tagged mesh-llm allowing rusqlite >= 0.41, the
+    # desktop's own rusqlite moving with it, and a sqlx-sqlite pin allowing libsqlite3-sys >= 0.39.
+    { id = "RUSTSEC-2026-0459", reason = "risk accepted, not absent: no upgrade until a tagged mesh-llm allows rusqlite >= 0.41, and the desktop opens archive.db inside the nest, where a sandboxed agent could plant a crafted db and -wal pair" },
     # zip < 9: ZipArchive::extract aborts the process on a symlink entry with a large declared size. Fixed only in 9.0.0.
     # Same copies and reasoning as 0367-0369 below. 8.6.0 via mesh-llm v0.76.2 (root via buzz-mesh-smoke; desktop via the
     # mesh-llm feature, off in Dreamforge releases): its readers never call extract(). 4.6.1 via tauri-plugin-updater (Windows):