diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1017b2cbe..945ae5fa0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
+### Security
+
+- Bumped the transitively-pinned `spin` crate off two yanked versions in `Cargo.lock`:
+  `0.9.8 -> 0.9.9` (via `flume 0.12.0` -> `sqlx-sqlite 0.9.0` -> `sqlx 0.9.0`) and
+  `0.10.0 -> 0.10.1` (via `pprof 0.15.0`, `bench` feature). Both were flagged as yanked
+  by `cargo audit` / `cargo deny check advisories`; the patch-level bumps carry no API
+  changes and required no `Cargo.toml` edits (#6249).
+
 ### Added
 
 - **TUI**: added a read-only settings view (`S` key or the `settings` command-palette
diff --git a/Cargo.lock b/Cargo.lock
index 4baae00c5..e901b2148 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2765,7 +2765,7 @@ checksum = "5e139bc46ca777eb5efaf62df0ab8cc5fd400866427e56c68b22e414e53bd3be"
 dependencies = [
  "futures-core",
  "futures-sink",
- "spin 0.9.8",
+ "spin 0.9.9",
 ]
 
 [[package]]
@@ -5720,7 +5720,7 @@ dependencies = [
  "prost-derive 0.12.6",
  "sha2 0.10.9",
  "smallvec",
- "spin 0.10.0",
+ "spin 0.10.1",
  "symbolic-demangle",
  "tempfile",
  "thiserror 2.0.18",
@@ -7662,18 +7662,18 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
 dependencies = [
  "lock_api",
 ]
 
 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 dependencies = [
  "lock_api",
 ]