diff --git a/CLAUDE.md b/CLAUDE.md
index 44cde76..c1e4fef 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -41,6 +41,16 @@ Release-plz automation.
   running". Use `#[rocket::async_test]` and `async fn`, even when the body never
   awaits.
 
+## Dependencies
+- cryptify has no IRMA/Yivi client of its own. Attributes arrive already signed
+  inside the PostGuard-sealed file and are read back through `pg-core`'s Unsealer,
+  so nothing here talks to a Yivi session server.
+- `pg-core` depends on the `irma` crate, so `irma` 0.2.1 is still compiled into the
+  binary even though cryptify does not declare it (`cargo tree -i irma`). It drags
+  in `reqwest` 0.11.27 too, alongside cryptify's own `reqwest` 0.13.4. Dropping the
+  direct declaration does not take `irma` out of the build; check `Cargo.toml` to
+  tell direct from transitive.
+
 ## Running the binary
 - Needs a reachable PKG server (`pkg_url`) at startup or it panics on
   `/v2/sign/parameters`. For config tests, prefer a serde-roundtrip unit test over
diff --git a/Cargo.lock b/Cargo.lock
index f126748..bd2e377 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -454,7 +454,6 @@ dependencies = [
  "askama",
  "chrono",
  "futures",
- "irma",
  "lettre",
  "log",
  "minreq",
diff --git a/Cargo.toml b/Cargo.toml
index 5979c96..8eadaab 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,6 @@ description = "End-to-end encrypted file sharing service"
 [dependencies]
 askama = "0.16.0"
 chrono = { version = "0.4.45", features = ["unstable-locales"] }
-irma = "0.2.1"
 lettre = "0.11.22"
 log = "0.4.33"
 rand = "0.10.1"