diff --git a/.github/workflows/_ci-security.yml b/.github/workflows/_ci-security.yml
index 29855e8f781..87c722c0ab9 100644
--- a/.github/workflows/_ci-security.yml
+++ b/.github/workflows/_ci-security.yml
@@ -27,6 +27,11 @@ jobs:
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Dependency policy
         run: cargo-deny check
+      # desktop/src-tauri is excluded from the root workspace and has its own
+      # Cargo.lock; it uses the root deny.toml.
+      - name: Desktop dependency policy
+        if: ${{ !cancelled() }}
+        run: cargo-deny --manifest-path desktop/src-tauri/Cargo.toml check
 
 
   results:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a1ff1c47fe6..c70729c00d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -255,10 +255,10 @@ jobs:
   security-domain:
     name: Security Domain
     needs: [changes]
-    if: github.event_name == 'push' || needs.changes.outputs.rust == 'true'
+    if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true'
     uses: ./.github/workflows/_ci-security.yml
     with:
-      rust: ${{ needs.changes.outputs.rust == 'true' }}
+      rust: ${{ needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true' }}
 
   rust-lint:
     name: Rust Lint
@@ -430,7 +430,7 @@ jobs:
 
   security:
     name: Security
-    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.rust == 'true')))
+    if: always() && (needs.changes.result != 'success' || github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true')
     needs: [changes, security-domain]
     runs-on: ubuntu-latest
     timeout-minutes: 5
diff --git a/deny.toml b/deny.toml
index f99df8481f5..a254962a57e 100644
--- a/deny.toml
+++ b/deny.toml
@@ -15,6 +15,23 @@ ignore = [
     # remove these when upstream catches up.
     { id = "RUSTSEC-2026-0194", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" },
     { id = "RUSTSEC-2026-0195", reason = "transitive via rust-s3 and mesh-llm→plist; trusted-input XML only; no upstream fix available yet" },
+    # Desktop workspace (desktop/src-tauri) — unmaintained crates with no safe upgrade.
+    # audiopus_sys: via `opus` 0.3 (huddle Opus decoder); fix is switching Opus bindings.
+    { id = "RUSTSEC-2026-0150", reason = "desktop: audiopus_sys via opus; no maintained replacement adopted yet" },
+    # ringbuf 0.3.3: via `neteq` 0.8 (huddle jitter buffer). neteq declares ringbuf but its source never
+    # calls it, so Consumer::skip/clear (the affected functions) are unreachable; every neteq release,
+    # 0.9.1 included, still requires ringbuf ^0.3. Drop this when neteq moves to ringbuf >= 0.5.2.
+    { id = "RUSTSEC-2026-0293", reason = "desktop: ringbuf 0.3 via neteq, which never calls it; no neteq release allows >= 0.5.2" },
+    # mach 0.1.2 / 0.3.2: via `user-idle` 0.6 (macOS idle detection).
+    { id = "RUSTSEC-2020-0168", reason = "desktop: mach via user-idle; no upstream fix available" },
+    # proc-macro-error: via tauri → tray-icon → gtk 0.18 → glib-macros (Linux only).
+    { id = "RUSTSEC-2024-0370", reason = "desktop: proc-macro-error via tauri's gtk 0.18 stack; waits on tauri" },
+    # unic-*: via tauri-utils → urlpattern 0.3.
+    { id = "RUSTSEC-2025-0075", reason = "desktop: unic-char-range via tauri-utils → urlpattern; waits on tauri" },
+    { id = "RUSTSEC-2025-0080", reason = "desktop: unic-common via tauri-utils → urlpattern; waits on tauri" },
+    { id = "RUSTSEC-2025-0081", reason = "desktop: unic-char-property via tauri-utils → urlpattern; waits on tauri" },
+    { id = "RUSTSEC-2025-0098", reason = "desktop: unic-ucd-version via tauri-utils → urlpattern; waits on tauri" },
+    { id = "RUSTSEC-2025-0100", reason = "desktop: unic-ucd-ident via tauri-utils → urlpattern; waits on tauri" },
     # unsafe-libyaml 0.2.11: unmaintained (no vulnerability), via serde_yaml. No maintained
     # drop-in is adopted upstream yet; owner chose to ignore it on 2026-10-12.
     { id = "RUSTSEC-2024-0449", reason = "unmaintained, no safe upgrade; via serde_yaml" },