diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 9f5f74578..44486fc12 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -40,16 +40,7 @@ jobs:
 
       - name: Run cargo audit
         working-directory: backend
-        shell: bash
-        run: |
-          # 临时接受此中危风险以保持 Codex 0.154.0 的 TLS 指纹；直接升级会新增 ML-DSA 签名算法。
-          # 仅豁免本条公告，2026-09-21 UTC 起恢复阻断；兼容升级验证完成后应提前删除豁免。
-          # https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc
-          audit_advisory_args=()
-          if [[ "$(date -u +%F)" < "2026-09-21" ]]; then
-            audit_advisory_args+=(--ignore RUSTSEC-2026-0285)
-          fi
-          cargo audit "${audit_advisory_args[@]}"
+        run: cargo audit
 
   frontend-security:
     runs-on: ubuntu-latest
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index facca96df..0f46d1c1d 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -154,9 +154,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.16.2"
+version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -165,14 +165,15 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.39.0"
+version = "0.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa7e52a4c5c547c741610a2c6f123f3881e409b714cd27e6798ef020c514f0a"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
+ "pkg-config",
 ]
 
 [[package]]
@@ -3157,9 +3158,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.36"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -3195,9 +3196,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "aws-lc-rs",
  "ring",
diff --git a/backend/crates/providers/openai/Cargo.toml b/backend/crates/providers/openai/Cargo.toml
index e676ee1b9..8742b2c55 100644
--- a/backend/crates/providers/openai/Cargo.toml
+++ b/backend/crates/providers/openai/Cargo.toml
@@ -26,7 +26,7 @@ hex = "0.4.3"
 # TLS 依赖按官方 Core 锁文件固定，包含用于约束传递依赖的直接声明。
 # hyper 受 workspace 的 SOCKS IPv6 修复补丁约束，保留补丁要求的兼容版本。
 # 升级前须重复采样 ClientHello，核对算法、扩展集合及排序约束、key_share 与 ALPN。
-aws-lc-rs = "=1.16.2"
+aws-lc-rs = "=1.18.1"
 hyper = { version = "=1.11.1", default-features = false }
 hyper-rustls = "=0.27.7"
 hyper-util = { version = "0.1.20", features = ["client-legacy", "http1", "tokio"] }
@@ -38,7 +38,7 @@ roxmltree = "0.21.1"
 semver = "1.0.27"
 # 与官方 rustls 路径一致：aws-lc 支持 P-521，优先提供 X25519MLKEM768。
 # reqwest 的 roots feature 仍会编译 ring；实际 provider 由 TLS 初始化显式选择。
-rustls = { version = "=0.23.36", default-features = false, features = ["aws_lc_rs", "prefer-post-quantum", "std", "tls12"] }
+rustls = { version = "=0.23.45", default-features = false, features = ["aws_lc_rs", "prefer-post-quantum", "std", "tls12"] }
 rustls-native-certs = "=0.8.3"
 rustls-pki-types = "=1.14.0"
 secrecy = "0.10.3"
diff --git a/backend/crates/providers/openai/tests/transport/tls.rs b/backend/crates/providers/openai/tests/transport/tls.rs
index 746e16a04..18d7c41e8 100644
--- a/backend/crates/providers/openai/tests/transport/tls.rs
+++ b/backend/crates/providers/openai/tests/transport/tls.rs
@@ -4,7 +4,7 @@ use bytes::{Buf as _, Bytes};
 
 use super::*;
 
-// 2026-09-14 从 Desktop 26.908.40834 / Core 0.154.0 抓取。
+// 2026-09-19 从 Desktop 26.915.31945 / Core 0.155.0-alpha.9.2 各重复抓取三次。
 // HTTP/native-tls 的扩展顺序固定；WebSocket/rustls 会随机化扩展顺序和临时密钥。
 #[derive(Debug, PartialEq, Eq)]
 struct ClientHello {
@@ -128,7 +128,9 @@ fn official_websocket_hello() -> ClientHello {
         ],
         extensions: vec![0, 5, 10, 11, 13, 23, 35, 43, 45, 51],
         groups: vec![4588, 29, 23, 24],
-        signature_algorithms: vec![1283, 1027, 1539, 2055, 2054, 2053, 2052, 1537, 1281, 1025],
+        signature_algorithms: vec![
+            1283, 1027, 1539, 2055, 2054, 2053, 2052, 1537, 1281, 1025, 2308, 2309, 2310,
+        ],
         key_shares: vec![(4588, 1216), (29, 32)],
         alpn: Vec::new(),
     }