diff --git a/Cargo.lock b/Cargo.lock
index bff366edc..6274e054f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -534,9 +534,9 @@ dependencies = [
 
 [[package]]
 name = "bigdecimal"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d6867f1565b3aad85681f1015055b087fcfd840d6aeee6eee7f2da317603695"
+checksum = "8fa3f3d8cbf4dffcfe4991de61d012bef509a409ecbe9dd41049bfe32b4d4653"
 dependencies = [
  "autocfg",
  "libm",
@@ -918,7 +918,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1482,7 +1482,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4450,7 +4450,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4508,7 +4508,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5235,10 +5235,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5680,7 +5680,7 @@ version = "2.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5283634e518fe9e82c7b20520bb4bc209009fd16c82077c802f8111ecbb0117a"
 dependencies = [
- "rand 0.9.5",
+ "rand 0.10.3",
 ]
 
 [[package]]
@@ -6049,7 +6049,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index 07d0ce730..0998c2050 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -42,6 +42,12 @@ criteria = "safe-to-deploy"
 delta = "0.44.0 -> 0.45.0"
 notes = "Reviewed C/FFI and generated symbol-prefix delta. EVP buffers final padded block; GCM checks IV length before subtraction; ML-DSA exact signature/extmu sizes, ML-KEM constant-time validation and parameter bounds retained. Keccak contexts bounded and cleansed; Brainpool immutable once groups. Builder flags preserve jitterentropy O0; fixed CPU discovery and existing compiler toolchain only. Source safety review, not cryptographic proof."
 
+[[audits.bigdecimal]]
+who = "Mykhailo Chalyi <mike@chaliy.name>"
+criteria = "safe-to-deploy"
+delta = "0.4.10 -> 0.4.11"
+notes = "Reviewed allocation-reduction delta: new in-place assign paths (addassign_scaled_biguint, mulassign_bigdecimal_ref, mulassign_bigint_biguint_ref) and a WithScale wrapper replace clone-and-rebuild, and the inverse Newton iteration reuses one scratch BigDecimal. New division and exp modules: the exp series loop is bounded by 2*precision with a minimum of 10, division asserts a non-zero denominator and uses checked_sub on bit counts. Digit/bit count helpers go through f64, where Rust's saturating casts bound the result. No unsafe, no fs/net/process/env access, build.rs unchanged, no new dependencies; Cargo.toml adds only a clippy lint level."
+
 [[audits.blake2]]
 who = "Mykhailo Chalyi <mike@chaliy.name>"
 criteria = "safe-to-deploy"