diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index e3406fbe..390c6540 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -419,9 +419,9 @@ dependencies = [
 
 [[package]]
 name = "calamine"
-version = "0.36.1"
+version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fa68281b1a76b54a62156474adb06bb380a67e07dd60656e3217152b42183f3"
+checksum = "c9ca341b94bc4b29e08970b1a03914fad2dfe177e2ecb67fcd6de9046004aafb"
 dependencies = [
  "atoi_simd",
  "byteorder",
@@ -430,9 +430,9 @@ dependencies = [
  "encoding_rs",
  "fast-float2",
  "log",
- "quick-xml",
+ "quick-xml 0.42.0",
  "serde",
- "zip 8.6.0",
+ "zip 9.0.5",
 ]
 
 [[package]]
@@ -2447,6 +2447,18 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.2"
@@ -2913,7 +2925,7 @@ checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
 dependencies = [
  "base64 0.22.1",
  "indexmap 2.14.0",
- "quick-xml",
+ "quick-xml 0.41.0",
  "serde",
  "time",
 ]
@@ -3055,6 +3067,15 @@ name = "quick-xml"
 version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
 dependencies = [
  "encoding_rs",
  "memchr",
@@ -6123,14 +6144,15 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e"
 dependencies = [
  "crc32fast",
  "flate2",
  "indexmap 2.14.0",
  "memchr",
+ "nix",
  "typed-path",
  "zopfli",
 ]
@@ -6187,7 +6209,7 @@ dependencies = [
  "tokio",
  "tokio-stream",
  "windows-sys 0.61.2",
- "zip 8.6.0",
+ "zip 9.0.5",
 ]
 
 [[package]]
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 2013cd33..bcc21ad4 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -39,11 +39,11 @@ keyring = { version = "3", features = ["windows-native", "apple-native", "sync-s
 sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio", "sqlite", "postgres", "mysql", "tls-rustls-ring"] }
 # Excel as a plain file reader (excel.rs): ZebraDesigner-parity without the
 # ODBC driver-manager tax. dates maps serial datetimes via chrono.
-calamine = { version = "0.36", features = ["dates"] }
+calamine = { version = "0.37", features = ["dates"] }
 # Already transitive via calamine; used directly in excel.rs to bound a
 # workbook's DECLARED uncompressed size before calamine materializes it, so a
 # decompression bomb can't defeat the compressed-only file-size cap.
-zip = { version = "8", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 # Typed errors inside the db/excel connector (stringified only at the IPC edge).
 # Already transitive via sqlx.
diff --git a/src-tauri/deny.toml b/src-tauri/deny.toml
index dd61bc29..5ef6d0fa 100644
--- a/src-tauri/deny.toml
+++ b/src-tauri/deny.toml
@@ -6,10 +6,11 @@
 [advisories]
 unmaintained = "workspace"
 yanked = "deny"
-# Every zip release below 9 is yanked.
+# The updater pins zip ^4 for its Windows bundle and only extracts signed updates.
 ignore = [
-    { crate = "zip@4.6.1", reason = "tauri-plugin-updater 2.14 pins zip ^4" },
-    { crate = "zip@8.6.0", reason = "calamine 0.36.1 pins zip ^8.6" },
+    { id = "RUSTSEC-2026-0367", reason = "zip 4 via the updater, fixed in zip 9" },
+    { id = "RUSTSEC-2026-0368", reason = "zip 4 via the updater, fixed in zip 9" },
+    { id = "RUSTSEC-2026-0369", reason = "zip 4 via the updater, fixed in zip 9" },
 ]
 
 [licenses]