diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 73650f1..e18fb8b 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -21,6 +21,7 @@ jobs:
     name: Rust vulnerability check (cargo-deny)
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         crate_dir: [agent, search]
     steps:
@@ -34,6 +35,9 @@ jobs:
     name: Go vulnerability check (govulncheck)
     runs-on: ubuntu-latest
     strategy:
+      # One module's findings must not cancel the other eight -- with
+      # fail-fast a single failure hid the whole matrix behind one log.
+      fail-fast: false
       matrix:
         # Same module list as license-compliance.yml's go-licenses job --
         # see that job's own comment for why cli/hack-webhook-sink/
@@ -53,7 +57,18 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version-file: ${{ matrix.module_dir }}/go.mod
+          # Deliberately NOT go-version-file. Each go.mod pins an exact
+          # patch (`go 1.25.0`), so go-version-file made CI scan against
+          # the *unpatched* 1.25.0 standard library and fail on 28
+          # stdlib CVEs -- crypto/x509 quadratic name-constraint parsing
+          # (GO-2025-4007) and friends, all fixed in 1.25.3. None of it
+          # was real: every Dockerfile builds `FROM golang:1.25-alpine`,
+          # a floating tag that resolves to the newest 1.25.x, so the
+          # shipped binaries already had the fixes. The go directive
+          # states the minimum language version, not the toolchain to
+          # audit with. Track the floating 1.25 line so this scans what
+          # production actually builds.
+          go-version: '1.25'
       - run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - name: Check for known vulnerabilities
         working-directory: ${{ matrix.module_dir }}
diff --git a/search/deny.toml b/search/deny.toml
index 9517449..4ea02f3 100644
--- a/search/deny.toml
+++ b/search/deny.toml
@@ -70,6 +70,23 @@ feature-depth = 1
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [
+    { id = "RUSTSEC-2024-0384", reason = """
+`instant` is unmaintained -- a maintenance advisory, not a vulnerability:
+no CVE, no known exploit, nothing to patch.
+
+It reaches us only transitively (tantivy 0.22.1 -> measure_time 0.8.3 ->
+instant 0.1.13), so it cannot be dropped without moving off the pinned
+Tantivy version, and CLAUDE.md pins the stack deliberately.
+
+The advisory's substance does not apply to this build either: `instant`
+exists to paper over std::time::Instant being unavailable on wasm, and
+the recommended replacement (web-time) addresses that same wasm gap.
+search builds for native musl, where instant is a thin pass-through to
+std.
+
+Revisit when Tantivy is next upgraded -- check whether measure_time has
+dropped the dependency, and delete this entry if so rather than letting
+it become permanent.""" },
     #"RUSTSEC-0000-0000",
     #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
     #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish