diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 025ae578..c94cc6a8 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -22,4 +22,11 @@ ignore = [
     "RUSTSEC-2026-0094",
     "RUSTSEC-2026-0095",
     "RUSTSEC-2026-0096",
+    # quick-xml 0.39.4 via wayland-scanner 0.31.10 (build-time proc-macro,
+    # trusted protocol XML — not reachable at runtime). Fix merged upstream
+    # (Smithay/wayland-rs d07c4f91f2, quick-xml 0.41) but not released yet.
+    # Temporary: remove after `cargo update` once wayland-scanner > 0.31.10
+    # ships. Tracking: MAT-139. Review by 2026-10-15 (aligned with deny.toml).
+    "RUSTSEC-2026-0194",
+    "RUSTSEC-2026-0195",
 ]
diff --git a/.github/workflows/contributor.yml b/.github/workflows/contributor.yml
index 12d36cf0..f308aab5 100644
--- a/.github/workflows/contributor.yml
+++ b/.github/workflows/contributor.yml
@@ -19,11 +19,15 @@ jobs:
     steps:
       - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
 
-  welcome-pr:
-    name: Welcome New Contributors (PR)
-    if: github.event_name == 'pull_request' && github.event.action == 'opened'
+  welcome:
+    name: Welcome New Contributors
+    # first-interaction v3 requires both issue_message and pr_message at
+    # runtime (even though action.yml marks neither as required), so a single
+    # job handles both events with both messages supplied.
+    if: github.event.action == 'opened' && (github.event_name == 'pull_request' || github.event_name == 'issues')
     runs-on: ubuntu-latest
     permissions:
+      issues: write
       pull-requests: write
     steps:
       - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3.1.0
@@ -36,17 +40,6 @@ jobs:
             - [ ] `npx oxlint .` passes
             - [ ] All tests pass (`cargo test` and `npx vitest run`)
             - [ ] `CHANGELOG.md` updated under `[Unreleased]`
-
-  welcome-issue:
-    name: Welcome New Contributors (Issue)
-    if: github.event_name == 'issues' && github.event.action == 'opened'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3.1.0
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
           issue_message: |
             Thanks for opening your first issue! We'll take a look as soon as possible. In the meantime, please make sure you've provided enough context for us to reproduce or understand the problem.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8da04b5b..7892a71f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- `cargo audit` config now ignores RUSTSEC-2026-0194/0195 (quick-xml 0.39.4
+  via the `wayland-scanner` build-time proc-macro) with a documented review
+  date, matching the existing `deny.toml` triage. The fix is merged upstream
+  but unreleased; the ignore goes away once wayland-scanner > 0.31.10 ships
+  (MAT-139).
+
+### Fixed
+
+- Contributor Automation: `actions/first-interaction` v3 requires both
+  `issue_message` and `pr_message` at runtime, so the split welcome jobs
+  each crashed with "Input required and not supplied". Merged them into a
+  single job that supplies both messages.
+
 ### Changed
 
 - CI/release workflows: bumped all actions still targeting Node.js 20 to