diff --git a/Cargo.lock b/Cargo.lock
index 8688bb1..e87fe35 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1360,9 +1360,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "once_cell",
  "ring",
diff --git a/crates/turnloop/src/backend/watch.rs b/crates/turnloop/src/backend/watch.rs
index 6b1fb8b..9b5dc85 100644
--- a/crates/turnloop/src/backend/watch.rs
+++ b/crates/turnloop/src/backend/watch.rs
@@ -469,8 +469,10 @@ impl Watches {
                     && !shared
                     && let Some(inotify) = &self.inotify
                 {
+                    // Bionic declares the watch descriptor `u32`, glibc/musl `c_int`;
+                    // `wd >= 0` was checked above, so the conversion is lossless.
                     // SAFETY: live inotify descriptor and a watch owned by this loop.
-                    unsafe { libc::inotify_rm_watch(inotify.fd.as_raw_fd(), wd) };
+                    unsafe { libc::inotify_rm_watch(inotify.fd.as_raw_fd(), wd as _) };
                 }
             }
             #[cfg(not(any(target_os = "linux", target_os = "android")))]
diff --git a/crates/turnloop/src/fs/unix.rs b/crates/turnloop/src/fs/unix.rs
index 50d63ce..0887cd9 100644
--- a/crates/turnloop/src/fs/unix.rs
+++ b/crates/turnloop/src/fs/unix.rs
@@ -483,10 +483,15 @@ fn stat_fd(fd: RawFd) -> Result<FileMetadata> {
 fn set_errno(value: c_int) {
     // SAFETY: the thread-local errno location is valid for this thread.
     unsafe {
-        #[cfg(any(target_os = "linux", target_os = "android"))]
+        #[cfg(target_os = "linux")]
         {
             *libc::__errno_location() = value;
         }
+        #[cfg(target_os = "android")]
+        {
+            // Bionic has no `__errno_location`; its errno accessor is `__errno`.
+            *libc::__errno() = value;
+        }
         #[cfg(any(target_vendor = "apple", target_os = "freebsd"))]
         {
             *libc::__error() = value;
diff --git a/scripts/ci/policy.toml b/scripts/ci/policy.toml
index 25341a5..c7ce572 100644
--- a/scripts/ci/policy.toml
+++ b/scripts/ci/policy.toml
@@ -13,3 +13,13 @@ banned = [
   "async-executor", "async-global-executor", "futures-executor", "futures-runtime",
   "http-body", "http-body-util",
 ]
+
+# Owner-approved (2026-10-16) one-time soak exception: rustls 0.23.46 fixes
+# RUSTSEC-2026-0346/0347/0348/0349 against 0.23.45. Expires when the release
+# completes its 7-day soak (published 2026-10-14).
+[[security-exceptions]]
+crate = "rustls"
+version = "0.23.46"
+advisory = "RUSTSEC-2026-0346"
+reason = "rustls 0.23.46 fixes RUSTSEC-2026-0346, -0347, -0348 and -0349 in 0.23.45 (TLS secrets in Debug, ECH rejection data leak, brotli cert decompression DoS, ServerHello KX downgrade)"
+expires = 2026-10-21