diff --git a/Cargo.lock b/Cargo.lock
index 79645002..dd6c2c13 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4393,9 +4393,9 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.62.5"
+version = "0.62.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da7c230e0ed9cbeb92fbad6c8848985d6df2a1464c0dc247a021abd666e9005e"
+checksum = "b41043523e0edcbd4e31d00903e26f12994f63b21bae9904f7405c1ed92752a5"
 dependencies = [
  "aes 0.9.1",
  "aws-lc-rs",
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index fbd0818c..66201f20 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -128,6 +128,12 @@ criteria = "safe-to-deploy"
 delta = "0.62.4 -> 0.62.5"
 notes = "Reviewed delta: rejects channel-scoped messages unless the SSH channel is confirmed, and bounds queued application output when channel windows are exhausted; no unsafe code or new ambient capabilities, with regression and backpressure coverage."
 
+[[audits.russh]]
+who = "Mykhailo Chalyi <mike@chaliy.name>"
+criteria = "safe-to-deploy"
+delta = "0.62.5 -> 0.62.6"
+notes = "Reviewed delta: routes channel-open replies through a dedicated priority queue drained ahead of the bounded receivers, so a confirmation can no longer be silently dropped by a full queue or be overtaken by data for a channel that is not registered yet; enforces the server-side max_auth_attempts cap with a DISCONNECT while keeping publickey probes uncounted; and tolerates exactly one trailing comma in name-lists for OpenSSH interop, still rejecting a bare comma and a doubled separator. No new unsafe code (unchanged single occurrence), no new dependencies, and no ambient capability changes; each behaviour change lands with test coverage."
+
 [[audits.rustls-webpki]]
 who = "Mykhailo Chalyi <mike@chaliy.name>"
 criteria = "safe-to-deploy"