diff --git a/.cargo/audit.toml b/.cargo/audit.toml
new file mode 100644
index 0000000..67823ea
--- /dev/null
+++ b/.cargo/audit.toml
@@ -0,0 +1,16 @@
+# cargo-audit configuration.
+#
+# Advisories listed here are reviewed and deliberately not actionable. Each
+# entry records why, so the next person does not have to re-derive it.
+
+[advisories]
+ignore = [
+    # RUSTSEC-2026-0189 - DNS rebinding in rmcp's Streamable HTTP server
+    # transport. tempyr does not build or use that transport: the workspace
+    # enables only `features = ["transport-io"]`, and tempyr-mcp serves over
+    # `rmcp::transport::stdio` exclusively. Upgrading past 1.3 is a separate
+    # API migration (1.4 removes `handler::server::common::schema_for_input`
+    # and 1.8 additionally breaks `list_roots`), so it is tracked on its own
+    # rather than folded into a dependency refresh.
+    "RUSTSEC-2026-0189",
+]
diff --git a/Cargo.lock b/Cargo.lock
index ceef8aa..8f2f282 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -551,9 +551,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -738,7 +738,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -818,7 +818,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1120,9 +1120,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2678,7 +2678,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3120,7 +3120,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3977,7 +3977,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/crates/tempyr-cli/src/commands/journal_init.rs b/crates/tempyr-cli/src/commands/journal_init.rs
index e0f66ce..48768a7 100644
--- a/crates/tempyr-cli/src/commands/journal_init.rs
+++ b/crates/tempyr-cli/src/commands/journal_init.rs
@@ -101,17 +101,15 @@ fn git_remote_url(repo_root: &Path, remote: &str) -> Option<String> {
 pub fn parse_owner_repo_from_url(url: &str) -> Option<(String, String)> {
     let lower = url.to_ascii_lowercase();
     // Strip the host marker; whatever's left should be `<owner>/<repo>`.
-    let after_host = if let Some(rest) = lower.strip_prefix("https://github.com/") {
-        rest.to_string()
-    } else if let Some(rest) = lower.strip_prefix("http://github.com/") {
-        rest.to_string()
-    } else if let Some(rest) = lower.strip_prefix("git@github.com:") {
-        rest.to_string()
-    } else if let Some(rest) = lower.strip_prefix("ssh://git@github.com/") {
-        rest.to_string()
-    } else {
-        return None;
-    };
+    let after_host = [
+        "https://github.com/",
+        "http://github.com/",
+        "git@github.com:",
+        "ssh://git@github.com/",
+    ]
+    .into_iter()
+    .find_map(|prefix| lower.strip_prefix(prefix))?
+    .to_string();
     // Drop trailing `.git` and any trailing slash.
     let trimmed = after_host
         .trim_end_matches('/')
diff --git a/crates/tempyr-index/src/vector.rs b/crates/tempyr-index/src/vector.rs
index 16fdbe4..f41d162 100644
--- a/crates/tempyr-index/src/vector.rs
+++ b/crates/tempyr-index/src/vector.rs
@@ -162,8 +162,10 @@ pub(crate) fn embedding_to_blob(embedding: &[f32]) -> Vec<u8> {
 
 /// Convert raw byte blob back to f32 vector.
 pub(crate) fn blob_to_embedding(blob: &[u8]) -> Vec<f32> {
-    blob.chunks_exact(4)
-        .map(|chunk| f32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]))
+    blob.as_chunks::<4>()
+        .0
+        .iter()
+        .map(|chunk| f32::from_le_bytes(*chunk))
         .collect()
 }
 
diff --git a/crates/tempyr-journal-index/src/embed.rs b/crates/tempyr-journal-index/src/embed.rs
index 7ce89d6..e074c62 100644
--- a/crates/tempyr-journal-index/src/embed.rs
+++ b/crates/tempyr-journal-index/src/embed.rs
@@ -241,8 +241,8 @@ pub fn bytes_to_vec(bytes: &[u8]) -> Result<Vec<f32>> {
         )));
     }
     let mut out = Vec::with_capacity(bytes.len() / 4);
-    for chunk in bytes.chunks_exact(4) {
-        out.push(f32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]));
+    for chunk in bytes.as_chunks::<4>().0 {
+        out.push(f32::from_le_bytes(*chunk));
     }
     Ok(out)
 }