diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..55dadbd
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,11 @@
+# Keep foreign SIMD intrinsics out of the crypto crates, as ndarray's own
+# `.cargo/config.toml` does (all SIMD comes from `ndarray::simd`):
+#
+# - `curve25519_dalek_backend="serial"`: curve25519-dalek's build.rs otherwise
+#   auto-selects its AVX2 vector backend.
+# - `poly1305_force_soft`: poly1305 otherwise selects its AVX2 backend.
+#
+# Both are arch-neutral. A `RUSTFLAGS` environment variable REPLACES these
+# flags rather than adding to them; a caller that sets one must repeat them.
+[build]
+rustflags = ["--cfg", 'curve25519_dalek_backend="serial"', "--cfg", "poly1305_force_soft"]
diff --git a/Cargo.toml b/Cargo.toml
index 02bd4f5..783c9c7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -131,7 +131,30 @@ surrealdb-core   = { git = "https://github.com/AdaWorldAPI/surrealdb", branch =
 [profile.dev]
 debug = 0
 
-# ecdsa (pulled by p256 for ogar-oidc's ES256) resolves to the AdaWorldAPI fork
-# of RustCrypto/signatures, at the same 0.17.0 version crates.io carries.
+# RustCrypto crates resolve to their AdaWorldAPI forks (fork-first policy).
+#
+# Each fork's default branch is a major version ahead of what this graph uses,
+# so every entry pins the fork commit whose Cargo.toml carries exactly the
+# version crates.io would have resolved; a patch whose version does not match
+# is silently unused. `docs/UPSTREAM-DEPS.md` lists the crates that have no
+# matching commit in their fork and therefore still come from crates.io.
+#
+# These patches apply to builds of THIS workspace only. A consumer (a2ui-rs,
+# report-rs, …) that depends on OGAR crates gets the registry versions unless it
+# repeats this block: cargo never applies a dependency's [patch] downstream.
 [patch.crates-io]
+# p256's ECDSA (ogar-oidc ES256).
 ecdsa = { git = "https://github.com/AdaWorldAPI/signatures", rev = "5595c3b1bfa14022b46ec3cc662a87e49b954266" }
+# XChaCha20-Poly1305 (ndarray `encryption`, via ogar-encryption).
+chacha20poly1305 = { git = "https://github.com/AdaWorldAPI/AEADs", rev = "c5c199953aba561261bed1c55f62b9c19d0f49cf" }
+# The keystream comes from ndarray's own chacha20 0.9.1 fork, which adds an
+# `ndarray::simd::U32x16` backend; ndarray already folds it over the registry
+# crate inside its workspace, and this repeats that for OGAR.
+chacha20 = { git = "https://github.com/AdaWorldAPI/ndarray", branch = "master" }
+poly1305 = { git = "https://github.com/AdaWorldAPI/universal-hashes", rev = "35de31af7396fe57fa28265e91532c816183c47f" }
+# Ed25519 (ndarray `encryption`) and X448's curve (elliptic-curves fork).
+curve25519-dalek = { git = "https://github.com/AdaWorldAPI/curve25519-dalek", rev = "5312a0311ec40df95be953eacfa8a11b9a34bc54" }
+ed448-goldilocks = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "f5cb30ebc9c2ccdbeb56965cf0c037e250b8f9c9" }
+# ogar-auth's legacy 3DES-EDE2 / PBKDF1-MD5 transition.
+md-5 = { git = "https://github.com/AdaWorldAPI/hashes", rev = "026b0e81e90ba476a5d343a8e4efbc63b814737b" }
+des = { git = "https://github.com/AdaWorldAPI/block-ciphers", rev = "7de364ede310f1ea7080c99ddf1138aeb47f9a69" }
diff --git a/docs/UPSTREAM-DEPS.md b/docs/UPSTREAM-DEPS.md
index 678476f..045fcd8 100644
--- a/docs/UPSTREAM-DEPS.md
+++ b/docs/UPSTREAM-DEPS.md
@@ -23,6 +23,7 @@
 | 7 (`lance-graph-callcenter`) | dataset transactional commit boundary; tag-based version retention | LOCKED |
 | `ogar-auth` (identity / federation) | `lance_graph_contract::auth::ActorContext` (canonical identity envelope) + `sla::TenantId`; git dep, branch `main`, unpinned. Measured: OGAR base `5b82ae0`; resolved lance-graph-contract at `f859d484c46dda9725ace2dc870c73e95203edde` | CURRENT-CONTRACT (unpinned `main`; re-measure the resolved rev when it matters) |
 | `ogar-oidc` (OIDC ID-token verifier) | `p256` from AdaWorldAPI/elliptic-curves rev `739304e026fdf06cd1a31606e4db487d3f47c5ae` (the rev ndarray `encryption` pins); `ecdsa` 0.17.0 redirected by workspace `[patch.crates-io]` to AdaWorldAPI/signatures rev `5595c3b1bfa14022b46ec3cc662a87e49b954266`; Ed25519 via `ogar-encryption`. RS256: no RSA fork wired | CURRENT-CONTRACT (rev-pinned) |
+| RustCrypto forks (workspace `[patch.crates-io]`) | Patched to the fork commit carrying the exact resolved version: `ecdsa` 0.17.0 (signatures `5595c3b`), `chacha20poly1305` 0.10.1 (AEADs `c5c1999`), `chacha20` 0.9.1 (ndarray `vendor/chacha20`, branch `master`), `poly1305` 0.8.0 (universal-hashes `35de31a`), `curve25519-dalek` 4.1.3 (curve25519-dalek `5312a03`), `ed448-goldilocks` 0.14.0-pre.15 (elliptic-curves `f5cb30e`), `md-5` 0.10.6 (hashes `026b0e8`), `des` 0.8.1 (block-ciphers `7de364e`). Still crates.io, no fork commit at the resolved version: `sha2` 0.10.9 and 0.11.1, `sha1` 0.10.7, `blake2` 0.11.0, `ed25519-dalek` 2.2.0; trait crates (`aead`, `cipher`, `digest`, `universal-hash`, `signature`) and `hmac` have no fork checked. `.cargo/config.toml` sets `curve25519_dalek_backend="serial"` and `poly1305_force_soft`. Patches and flags apply to this workspace only, never to consumers | MEASURED (fresh `cargo generate-lockfile`, no unused-patch warning; `cargo build -v` shows both cfgs on curve25519-dalek and poly1305) |
 
 **Coordination notes**:
 - OGAR's `Identity::class_identity_versioned(prefix, class, n)` MUST produce a string that `NiblePath` can split losslessly.