diff --git a/.github/workflows/bench-advisory.yml b/.github/workflows/bench-advisory.yml
index 1b4b6d0..dc6dc79 100644
--- a/.github/workflows/bench-advisory.yml
+++ b/.github/workflows/bench-advisory.yml
@@ -25,12 +25,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: System deps (cpal / Opus)
+      - name: System deps (cpal / Opus / SDL2)
         run: |
           sudo apt-get update
           sudo apt-get install -y \
             libasound2-dev libpulse-dev pkg-config \
             libdbus-1-dev \
+            libsdl2-dev \
             libopus-dev
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24bbc71..7dd2542 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,12 +11,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: System deps (cpal / Opus / SQLite)
+      - name: System deps (cpal / Opus / SQLite / SDL2)
         run: |
           sudo apt-get update
           sudo apt-get install -y \
             libasound2-dev libpulse-dev pkg-config \
             libdbus-1-dev \
+            libsdl2-dev \
             libopus-dev
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
diff --git a/deny.toml b/deny.toml
index 3336c2d..38baef1 100644
--- a/deny.toml
+++ b/deny.toml
@@ -78,7 +78,13 @@ wildcards = "warn"
 highlight = "all"
 # Crates we never want, regardless of license. Empty by default.
 deny = []
-skip = []
+skip = [
+    # `tracing-android` still depends on android_log-sys 0.2.x while
+    # flutter_rust_bridge's `android_logger` uses 0.3.x. Both are
+    # Android-only logcat bindings; keep this targeted until upstreams
+    # converge.
+    { name = "android_log-sys", version = "0.2.0" },
+]
 skip-tree = []
 
 # ---------- Sources ----------