diff --git a/CHANGELOG.md b/CHANGELOG.md
index 98a6314a..378629a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,14 @@ Releases before `0.2.5` predate the public launch; their notes live in the
 
 ### Security
 
+- **rustls moves to 0.23.46.** ([#616](https://github.com/lacs-project/sysknife/pull/616))
+  RUSTSEC-2026-0346 to 0349 reached the brain through reqwest, which carries
+  provider calls, and the daemon through sqlx's Postgres TLS. The worst of the
+  four is `Debug` output that printed TLS session secrets. The others are a
+  key-exchange downgrade hint, a pre-authentication Brotli allocation that is
+  off by default, and early data sent after an ECH rejection. The patch release
+  changes no API.
+
 - **Read tools stop forwarding credentials to the LLM provider.**
   ([#573](https://github.com/lacs-project/sysknife/pull/573)) A journal line
   carrying a password assignment or a `Bearer` token reached the provider in a
diff --git a/Cargo.lock b/Cargo.lock
index 89a9896a..d78bcc71 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4005,9 +4005,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "once_cell",