diff --git a/.trivyignore b/.trivyignore
index 0d88dad2..3a32a838 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -30,3 +30,17 @@ CVE-2026-42577 exp:2026-09-11
 # /metrics; HTTP instrumentation via Vert.x, not micrometer-jetty/servlet binders
 # See: UID2-7662
 CVE-2026-40984 exp:2026-11-11
+
+# CVE-2026-66046 — libexpat (Alpine base-image OS library) (HIGH).
+# Not exploitable here: Dockerfile FROM eclipse-temurin:21-jre-alpine-3.23; pure-Java Vert.x
+# jar-with-dependencies. No loadLibrary/JNI/native XML refs in any src *.java; only XML on disk
+# is trusted conf/logback.xml. JVM parses XML via JAXP/Xerces, not native libexpat.
+# See: UID2-7800
+CVE-2026-66046 exp:2026-12-02
+
+# CVE-2026-76641 — libexpat (Alpine base-image native C library) (HIGH).
+# Not exploitable here: Dockerfile FROM eclipse-temurin@sha256:319339...(21-jre-alpine-3.23);
+# pure-Java Vert.x jar-with-dependencies, apk adds only libpng/libcrypto3/libssl3/musl/gnutls;
+# no libexpat added and no JNI/native XML path in any *.java
+# See: UID2-7801
+CVE-2026-76641 exp:2026-12-02