diff --git a/Cargo.lock b/Cargo.lock
index 1436949..b19b426 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -121,9 +121,9 @@ checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
 [[package]]
 name = "device-driver"
-version = "2.1.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2503fa8477e63231b485f927f7e578cf05de86ab8a883f6d7b401d8adcd169c4"
+checksum = "c38a909a99943e2348df3f1ec63c9bf4ad84aa2f38484db17be88ec067d7344b"
 
 [[package]]
 name = "embedded-hal"
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index 6452b3f..c9eac4e 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -35,6 +35,38 @@ proc-macro and embedded-io subtree that v1 pulled in is gone.
 Assisted-by: opencode:claude-opus-5
 """
 
+[[audits.device-driver]]
+who = "Felipe Balbi <febalbi@microsoft.com>"
+criteria = "safe-to-deploy"
+delta = "2.1.0 -> 2.1.1"
+notes = """
+No-op for the runtime crate. `src/` is byte-identical between the two
+published packages, so every conclusion in the 1.0.9 -> 2.1.0 audit carries
+forward unchanged: no build script (`build = false` still holds), the sole
+powerful import is still the rustdoc `include_str!(concat!("../",
+env!("CARGO_PKG_README")))` in lib.rs, and the unsafe surface (the lsb0
+bit-packing helpers in ops.rs and `unsafe trait Fieldset` in fieldset.rs) is
+untouched.
+
+The three fixes in the 2.1.1 release notes -- the `defmt::Format` derives on
+generated devices and blocks, the MIR-pass speedup with its identifier `Hash`
+and `PartialEq` corrections, and the inclusive-vs-exclusive range fix for
+repeated fields -- all land in `device-driver-generation`, not here. tmp108
+depends on device-driver with `default-features = false` and enables neither
+`macros` nor `defmt`, so none of that code is in our dependency graph;
+`cargo tree -e normal -p device-driver` still shows it with zero transitive
+dependencies.
+
+What is left in the delta is packaging only: the version bump itself, the
+pinned optional `device-driver-macros` dep moving `=2.1.0 -> =2.1.1` (not
+enabled here), a new `[[test]]` target plus its `tests/repeats.rs` regression
+test for the repeated-field fix, and the removal of the explicit
+`readme = "README.md"` key from the workspace-side Cargo.toml. That last one
+is cosmetic: the packaged manifest cargo publishes still carries
+`readme = "README.md"`, so `CARGO_PKG_README` resolves as before. Test code
+is not compiled into the library and adds no capability to a consumer.
+"""
+
 [[audits.device-driver-generation]]
 who = "Jerry Xie <jerryxie@microsoft.com>"
 criteria = "safe-to-deploy"