diff --git a/.cargo-deny.toml b/.cargo-deny.toml
index 4cb03f9..ab01959 100644
--- a/.cargo-deny.toml
+++ b/.cargo-deny.toml
@@ -15,6 +15,8 @@ ignore = [
   "RUSTSEC-2025-0012", # backoff unmaintained; upstream workspace still relies on it
   "RUSTSEC-2025-0055", # tracing-subscriber ansi escape issue; upstream dependency
   "RUSTSEC-2025-0134", # rustls-pemfile unmaintained; transitive via rustls stack
+  "RUSTSEC-2025-0141", # bincode unmaintained; no safe upgrade available
+  "RUSTSEC-2026-0002", # lru IterMut soundness issue; pending upstream upgrade
 ]
 yanked = "deny"
 
@@ -29,7 +31,6 @@ allow = [
   "BSD-2-Clause",
   "BSD-3-Clause",
   "BSL-1.0",
-  "BlueOak-1.0.0",
   "CC0-1.0",
   "CDLA-Permissive-2.0",
   "ISC",
diff --git a/testing-framework/assets/stack/scripts/docker/build_cfgsync.sh b/testing-framework/assets/stack/scripts/docker/build_cfgsync.sh
index e760250..bea43b4 100755
--- a/testing-framework/assets/stack/scripts/docker/build_cfgsync.sh
+++ b/testing-framework/assets/stack/scripts/docker/build_cfgsync.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-cargo build --all-features --manifest-path /workspace/testing-framework/tools/cfgsync/Cargo.toml --bins
+cargo build --all-features --manifest-path /workspace/testing-framework/tools/cfgsync_tf/Cargo.toml --bins
 
 cp /workspace/target/debug/cfgsync-server /workspace/artifacts/cfgsync-server
 cp /workspace/target/debug/cfgsync-client /workspace/artifacts/cfgsync-client