diff --git a/.trivyignore b/.trivyignore
index fc454ef7..d0bc5f85 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -31,14 +31,6 @@ CVE-2026-42577 exp:2026-09-11
 # See: UID2-7376
 CVE-2026-2100 exp:2026-09-01
 
-# CVE-2026-56131 / CVE-2026-56407 / CVE-2026-56408 — libexpat stack exhaustion / integer overflows
-# in the Alpine base image. uid2-admin is a pure Java service; the JVM parses XML via the built-in
-# JAXP/Xerces implementation, not the native libexpat C library, and there are no JNI bindings or
-# native deps that call into libexpat, so the crafted-XML attack path is not reachable. Fixed in
-# Alpine v3.23 libexpat >= 2.8.2-r0; the pinned eclipse-temurin base image has not yet been rebuilt with it.
-# See: UID2-7456
-CVE-2026-56131 exp:2026-08-09
-CVE-2026-56407 exp:2026-08-09
 # CVE-2026-56408 — libexpat (Alpine base image, transitive via eclipse-temurin:21-jre-
 # alpine-3.23) (HIGH).
 # Not exploitable here: Dockerfile FROM eclipse-temurin:21-jre-alpine-3.23; libexpat not apk-
@@ -47,12 +39,6 @@ CVE-2026-56407 exp:2026-08-09
 # See: UID2-7656
 CVE-2026-56408 exp:2026-11-11
 
-# jackson-core async parser maxNumberLength bypass (GHSA-r7wm-3cxj-wff9) - incomplete fix for
-# GHSA-72hv-8253-57qq. Not exploitable: services only use the synchronous ObjectMapper API, not
-# jackson-core's non-blocking/async parser. A jackson bump is also in flight via uid2-shared
-# (PR #631) and will flow on the next release. See: UID2-7557 (predecessor UID2-6670)
-GHSA-r7wm-3cxj-wff9 exp:2026-08-23
-
 # CVE-2026-40984 — io.micrometer:micrometer-core (transitive via micrometer-registry-
 # prometheus/-jmx); micrometer-jetty11/12 not present (HIGH).
 # Not exploitable here: pom.xml:112/126/132 vertx-micrometer + micrometer-registry-
@@ -60,3 +46,12 @@ GHSA-r7wm-3cxj-wff9 exp:2026-08-23
 # /metrics; HTTP instrumentation via Vert.x, not micrometer-jetty/servlet binders
 # See: UID2-7662
 CVE-2026-40984 exp:2026-11-11
+
+# CVE-2026-11822 / CVE-2026-11824 — sqlite-libs arbitrary code execution/crash via crafted
+# FTS5 input, in the Alpine base image (transitive via eclipse-temurin:21-jre-alpine-3.23).
+# Not exploitable here: sqlite-libs is not apk-added in the Dockerfile (only libpng/libcrypto3/
+# libssl3/musl/musl-utils/gnutls are); uid2-admin is a pure Java/Vert.x service with no SQLite/
+# JDBC dependency and no JNI bindings, so the FTS5 query engine is never invoked.
+# See: UID2-7748
+CVE-2026-11822 exp:2026-11-26
+CVE-2026-11824 exp:2026-11-26