diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 8c97d8ef..9d252c3f 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -16,6 +16,4 @@ ignore = [
     "RUSTSEC-2021-0006",
     # atomic-polyfill unmaintained — transitive via heapless 0.7.17 → postcard 1.1.3 → sema/krypta. heapless 0.8+ drops atomic-polyfill in favor of portable-atomic, but postcard 1.x has not yet bumped its heapless pin past 0.7. Track postcard upstream for the heapless bump.
     "RUSTSEC-2023-0089",
-    # proc-macro-error2 unmaintained — lockfile-only presence in the kernel graph via smoltcp 0.12's optional defmt feature (defmt-macros → defmt). The kernel enables smoltcp with default-features = false and no defmt feature, so the crate is never compiled. No safe upgrade until defmt migrates off proc-macro-error2. Surfaced by the #547 multi-graph scan.
-    "RUSTSEC-2026-0173",
 ]
diff --git a/Cargo.lock b/Cargo.lock
index 85175e41..f40491b7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1636,9 +1636,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smoltcp"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f73d40463bba65efc9adc6370b56df76d563cc46e2482bba58351b4afb7535e"
+checksum = "b6f8b28ad56c6e35524a37dd492af5d1a47e31e1a4d175cd12f89c075f01980f"
 dependencies = [
  "bitflags 1.3.2",
  "byteorder",
diff --git a/Cargo.toml b/Cargo.toml
index bce31c55..e2cfc855 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -118,7 +118,7 @@ sha2 = "0.11"
 x25519-dalek = { version = "3", features = ["static_secrets", "zeroize"] }
 
 # Networking
-smoltcp = { version = "0.13", default-features = false, features = [
+smoltcp = { version = "0.14", default-features = false, features = [
     "medium-ethernet",
     "proto-ipv4",
     "proto-ipv6",
diff --git a/crates/thumos/Cargo.lock b/crates/thumos/Cargo.lock
index 570cf1ee..9cf7709c 100644
--- a/crates/thumos/Cargo.lock
+++ b/crates/thumos/Cargo.lock
@@ -245,15 +245,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "defmt"
-version = "0.3.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad"
-dependencies = [
- "defmt 1.1.1",
-]
-
 [[package]]
 name = "defmt"
 version = "1.1.1"
@@ -676,14 +667,14 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smoltcp"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f73d40463bba65efc9adc6370b56df76d563cc46e2482bba58351b4afb7535e"
+checksum = "b6f8b28ad56c6e35524a37dd492af5d1a47e31e1a4d175cd12f89c075f01980f"
 dependencies = [
  "bitflags",
  "byteorder",
  "cfg-if",
- "defmt 0.3.100",
+ "defmt",
  "heapless",
  "managed",
 ]
diff --git a/crates/thumos/Cargo.toml b/crates/thumos/Cargo.toml
index 8c6e4aa9..7adc0f14 100644
--- a/crates/thumos/Cargo.toml
+++ b/crates/thumos/Cargo.toml
@@ -186,7 +186,7 @@ serde = { version = "1", default-features = false, features = [
     "derive",
     "alloc",
 ] }
-smoltcp = { version = "0.13", default-features = false, features = [
+smoltcp = { version = "0.14", default-features = false, features = [
     "medium-ethernet",
     "proto-ipv4",
     "socket-tcp",
diff --git a/deny.toml b/deny.toml
index 80a093ba..c4f467ef 100644
--- a/deny.toml
+++ b/deny.toml
@@ -41,10 +41,6 @@ reason = "False positive: same collision as RUSTSEC-2020-0128. The flagged `cach
 id = "RUSTSEC-2023-0089"
 reason = "atomic-polyfill unmaintained — transitive via heapless 0.7.17 → postcard 1.1.3 → sema/krypta. heapless 0.8+ drops atomic-polyfill in favor of portable-atomic, but postcard 1.x has not yet bumped its heapless pin past 0.7. Track postcard upstream for the heapless bump."
 
-[[advisories.ignore]]
-id = "RUSTSEC-2026-0173"
-reason = "proc-macro-error2 unmaintained — lockfile-only presence in the kernel graph via smoltcp 0.12's optional defmt feature (defmt-macros → defmt). The kernel enables smoltcp with default-features = false and no defmt feature, so the crate is never compiled. No safe upgrade until defmt migrates off proc-macro-error2. Surfaced by the #547 multi-graph scan."
-
 [licenses]
 # WHY: license allow list mirrors aletheia's deny.toml. Each addition over
 # kanon's original list is for a real transitive dep:
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index 6e79b886..5a5b7431 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -369,9 +369,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "smoltcp"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f73d40463bba65efc9adc6370b56df76d563cc46e2482bba58351b4afb7535e"
+checksum = "b6f8b28ad56c6e35524a37dd492af5d1a47e31e1a4d175cd12f89c075f01980f"
 dependencies = [
  "bitflags 1.3.2",
  "byteorder",
diff --git a/osv-scanner.toml b/osv-scanner.toml
index 72cde3cc..1d9a5d72 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -21,7 +21,3 @@ reason = "False positive: same collision as RUSTSEC-2020-0128. The flagged `cach
 [[IgnoredVulns]]
 id = "RUSTSEC-2023-0089"
 reason = "atomic-polyfill unmaintained — transitive via heapless 0.7.17 → postcard 1.1.3 → sema/krypta. heapless 0.8+ drops atomic-polyfill in favor of portable-atomic, but postcard 1.x has not yet bumped its heapless pin past 0.7. Track postcard upstream for the heapless bump."
-
-[[IgnoredVulns]]
-id = "RUSTSEC-2026-0173"
-reason = "proc-macro-error2 unmaintained — lockfile-only presence in the kernel graph via smoltcp 0.12's optional defmt feature (defmt-macros → defmt). The kernel enables smoltcp with default-features = false and no defmt feature, so the crate is never compiled. No safe upgrade until defmt migrates off proc-macro-error2. Surfaced by the #547 multi-graph scan."