diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 2b704adc..0dda7aff 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -10,8 +10,11 @@ on:
 jobs:
   security_audit:
     runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      issues: write
     steps:
       - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v2.0.0
+      - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/Cargo.lock b/Cargo.lock
index a580e868..ea90505f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1263,13 +1263,13 @@ checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"
 
 [[package]]
 name = "duration-str"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709d653e7c92498eb29fb86a2a6f0f3502b97530f33aedb32ef848d4d28b31a3"
+checksum = "f88959de2d447fd3eddcf1909d1f19fe084e27a056a6904203dc5d8b9e771c1e"
 dependencies = [
  "rust_decimal",
  "serde",
- "thiserror 1.0.69",
+ "thiserror 2.0.3",
  "time",
  "winnow 0.6.8",
 ]
diff --git a/certifier/Cargo.toml b/certifier/Cargo.toml
index e55fcdca..30882d90 100644
--- a/certifier/Cargo.toml
+++ b/certifier/Cargo.toml
@@ -26,7 +26,7 @@ serde_json = "1.0.133"
 base64 = "0.22.1"
 axum-prometheus = "0.7.0"
 tower = { version = "0.5.1", features = ["limit", "load-shed", "buffer"] }
-duration-str = { version = "0.11.2", default-features = false, features = [
+duration-str = { version = "0.11.3", default-features = false, features = [
     "serde",
     "time",
 ] }