diff --git a/Cargo.lock b/Cargo.lock
index 084fbd3..b2594b4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1364,8 +1364,6 @@ dependencies = [
  "mail-builder 0.4.4",
  "mail-parser",
  "quick-xml",
- "rand 0.8.8",
- "rsa",
  "rustls-pki-types",
  "serde",
  "serde_json",
diff --git a/Cargo.toml b/Cargo.toml
index 0e6f662..5489a02 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,7 +44,14 @@ openmail-mcp     = { version = "0.1.0", path = "crates/openmail-mcp" }
 # --- third party (all Apache-2.0 or MIT; see NOTICE) ---
 mail-parser      = { version = "0.11", features = ["full_encoding"] }
 mail-builder     = "0.5"
-mail-auth        = { version = "0.12", features = ["generate"] }
+# NO "generate" feature. It pulls in the `rsa` crate, which carries
+# RUSTSEC-2023-0071 (Marvin Attack — private-key recovery through a timing
+# sidechannel observable over the network) with no fixed version available.
+# The default `aws-lc-rs` backend signs and verifies in constant time, which is
+# what a network service actually needs. DKIM keypair generation is a one-time
+# operator action and belongs in tooling (`openssl genpkey`), not in a daemon
+# listening on :25.
+mail-auth        = { version = "0.12" }
 smtp-proto       = "0.2"
 hickory-resolver = { version = "0.26", features = ["dnssec-ring"] }