diff --git a/sonar-project.properties b/sonar-project.properties
index 6e78dc7f7c..4bbfda2d8c 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,2 +1,9 @@
 sonar.projectKey=storytold_wordcraft
 sonar.organization=storytold
+
+# S4790 (weak hash): SHA-1 is what ODF 1.2 encryption (§4.16, manifest:start-key-generation and
+# manifest:checksum-type "SHA1/1K") names for files written by older office suites. It is needed
+# to open those files, not chosen for new security; new files use SHA-256.
+sonar.issue.ignore.multicriteria=odt_sha1
+sonar.issue.ignore.multicriteria.odt_sha1.ruleKey=rust:S4790
+sonar.issue.ignore.multicriteria.odt_sha1.resourceKey=crates/formats/src/odt/crypt.rs