diff --git a/deny.toml b/deny.toml
index 9d15a74d0b79b..a762ca592db05 100644
--- a/deny.toml
+++ b/deny.toml
@@ -330,6 +330,10 @@ ignore = [
     "RUSTSEC-2023-0071",
     # `launchdarkly-server-sdk` requires `lru ^0.16.3` in its latest release.
     "RUSTSEC-2026-0253",
+    # `unsafe-libyaml` is unmaintained. Pulled in by `serde_yaml`, which
+    # `mz-debug` and `mz-metrics-catalog` use directly and `kube-client` 3.x
+    # requires. kube-client 4 uses `serde-saphyr` instead.
+    "RUSTSEC-2024-0449",
 ]
 
 # Must be manually kept in sync with about.toml.