diff --git a/CLAUDE.md b/CLAUDE.md
index a19e8733..c8f8b44e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -242,7 +242,7 @@ Adding a new variant to the `Actions` enum always triggers an `enum_variant_adde
 
 ## Advisory Triage
 
-There is one advisory ignore list: `deny.toml`'s `[advisories].ignore`. Both the blocking `cargo-audit` job and the weekly `cargo-deny-scheduled.yml` read it, so triage a new advisory there once. `unsound` and `unmaintained` are set to `"all"`: cargo-deny's `unsound` default of `"workspace"` drops advisories in transitive crates, which hid RUSTSEC-2026-0306 and RUSTSEC-2026-0205. Raw `cargo audit` is no longer run in CI. A workflow `--ignore RUSTSEC` flag fails `tests/test_deny_policy.py`, which also checks that a GPL fixture is rejected and an MIT fixture accepted.
+There is one advisory ignore list: `deny.toml`'s `[advisories].ignore`. Both the blocking `cargo-audit` job and the weekly `cargo-deny-scheduled.yml` read it, so triage a new advisory there once. `unsound` and `unmaintained` are set to `"all"`: cargo-deny's `unsound` default of `"workspace"` drops advisories in transitive crates, which hid RUSTSEC-2026-0306 and RUSTSEC-2026-0205. Raw `cargo audit` is no longer run in CI. A workflow `--ignore RUSTSEC` flag, or `unsound`/`unmaintained` set to anything but `"all"`, fails `tests/test_deny_policy.py`, which also checks that a GPL fixture is rejected and an MIT fixture accepted.
 
 ## Branch Workflow
 
diff --git a/tests/test_deny_policy.py b/tests/test_deny_policy.py
index 75048253..bf4812f7 100644
--- a/tests/test_deny_policy.py
+++ b/tests/test_deny_policy.py
@@ -6,6 +6,7 @@
 from pathlib import Path
 
 import pytest
+import tomllib
 
 REPO = Path(__file__).resolve().parent.parent
 FIXTURES = REPO / "tests/fixtures/deny"
@@ -78,3 +79,13 @@ def test_one_ignore_list_no_workflow_has_its_own() -> None:
     assert files
     offenders = [f.name for f in files if "--ignore RUSTSEC" in f.read_text()]
     assert offenders == []
+
+
+def test_advisories_cover_transitive_crates() -> None:
+    """cargo-deny 0.20.2 defaults `unsound` to "workspace", which hid
+    RUSTSEC-2026-0306 and -0205 (etch-cli#159). The fixtures cannot see this
+    setting, so pin both scope keys explicitly."""
+    with (REPO / "deny.toml").open("rb") as handle:
+        advisories = tomllib.load(handle)["advisories"]
+    assert advisories.get("unsound") == "all"
+    assert advisories.get("unmaintained") == "all"