diff --git a/deny.toml b/deny.toml
index d897dce..268313f 100644
--- a/deny.toml
+++ b/deny.toml
@@ -70,11 +70,18 @@ deny = []
 # Skip specific dependencies from multiple-version checks
 # These are transitive dependencies where version duplication is unavoidable
 skip = [
-    # getrandom 0.2.x (aes-gcm crypto chain) vs 0.4.x (tempfile/cbindgen build-dep)
+    # getrandom 0.2.x (aes-gcm crypto chain) vs the newer major tempfile pulls in
+    # through the cbindgen build-dep (0.4.x up to cbindgen 0.29.2, 0.3.x from 0.29.4)
     { crate = "getrandom@0.2", reason = "Transitive via aes-gcm crypto chain" },
     # winnow 0.7.x vs 1.x — both pulled by toml@0.9 (direct + via toml_parser)
     # through cbindgen build-dependency; internal split, can't resolve
     { crate = "winnow@0.7", reason = "Transitive via toml/cbindgen (build-dependency)" },
+    # syn 2.x (cbindgen build-dep, zeroize_derive) vs 3.x (serde_derive, thiserror-impl);
+    # proc-macro/build-time only, clears once the graph moves to syn 3
+    { crate = "syn@2", reason = "Ecosystem mid-migration to syn 3; serde_derive and thiserror-impl moved first" },
+    # windows-sys 0.52.x (tempfile -> rustix/errno) vs 0.61.x (clap's anstyle crates),
+    # both under the cbindgen build-dep; Windows-only bindings
+    { crate = "windows-sys@0.52", reason = "Transitive via cbindgen (build-dependency) crates on an older windows-sys" },
 ]
 
 # Skip crate trees entirely (e.g., frequently-updated foundational crates)