Katsas, Circuit Judge

James E. Tysse argued the cause for appellants. With him on the briefs were Caroline L. Wolverton and Lide E. Paterno.

Daniel J. Aguilar, Attorney, U.S. Department of Justice, argued the cause for appellees. With him on the brief were Brian M. Boynton, Principal Deputy Assistant Attorney General, and Sharon Swingle, Attorney.

Times Wang and Jennifer J. Rosenbaum were on the brief for amici curiae Global Labor Justice - International Labor Rights Forum, et al. in support of appellees.

Before: Rogers, Millett and Katsas, Circuit Judges.

Katsas, Circuit Judge:

This case presents the question whether the Export Control Reform Act of 2018 (ECRA) and its implementing regulations permit the Department of Commerce to restrict exports to foreign entities that violate human rights. The plaintiffs here contend that such restrictions contravene clear and mandatory legal limits enforceable through ultra vires review. The district court held that this claim is unlikely to succeed and thus denied a preliminary injunction. We affirm on the same ground.

I

A

ECRA confers various powers and duties on the Secretary of Commerce, acting for the President and in consultation with other agency heads. The statute also identifies various national-security and foreign-policy interests of the United States in the specific context of export controls.

Section 4813(a) of Title 50 sets forth the Secretary's responsibilities under ECRA. It requires her to "establish and maintain a list of foreign persons" who have been "determined to be a threat to the national security and foreign policy of the United States pursuant to the policy set forth in section 4811(2)(A) of this title." 50 U.S.C. § 4813(a)(2). Section 4813(a) also requires the Secretary to establish and maintain a list of controlled items, id. § 4813(a)(1), and to restrict exports of these items to the listed foreign persons who present a threat, id. § 4813(a)(4). Section 4813(a) requires the Secretary to take various other substantive, licensing, and compliance actions related to export controls. Id. § 4813(a)(3), (5)–(15). Finally, it directs the Secretary to "undertake any other action as is necessary to carry out this subchapter that is not otherwise prohibited by law." Id. § 4813(a)(16).

Section 4811(2) of Title 50 states that the "national security and foreign policy of the United States require" export controls for purposes set out in ensuing subsections. Subsection (A) references controlling (i) the proliferation of weapons of mass destruction or conventional weapons, (ii) the acquisition of destabilizing numbers or types of conventional weapons, (iii) terrorism, (iv) military programs posing a threat to the United States, and (v) the disruption of critical infrastructure. Subsections (B) and (C) refer to preserving the United States’ military superiority and strengthening its defense industrial base. Subsection (D) refers to carrying out "the foreign policy of the United States, including the protection of human rights and the promotion of democracy."

With two exceptions not applicable here, ECRA provides that "the functions exercised" under it are not subject to the judicial-review provisions of the Administrative Procedure Act. 50 U.S.C. § 4821(a).

B

Acting under ECRA and its predecessor statutes, the Department of Commerce has maintained a so-called Entity List to restrict designated foreign parties from receiving United States exports. A foreign party may be added to the list if it is "involved in activities that are contrary to the national security or foreign policy interests of the United States." 15 C.F.R. § 744.11(b). Listed entities generally may not receive exports. Id. § 744.11(a)(1) & Pt. 744, Supp. No. 4.

In 2012, the Department began stating that human-rights abuses are "contrary to U.S. national security or foreign policy interests" and thus make the abusers eligible for the Entity List. 77 Fed. Reg. 71,097 (Nov. 29, 2012). But the Department did not add anyone to the list for human-rights abuses until October 2019, when it listed several companies for oppressing various religious and ethnic minorities in China's Xinjiang Uyghur Autonomous Region. 84 Fed. Reg. 54,002 (Oct. 9, 2019). Since then, the Department has added many other Chinese companies to the Entity List for repressing minorities in Xinjiang. E.g. , 86 Fed. Reg. 33,119 (June 24, 2021) ; 85 Fed. Reg. 34,503 (June 5, 2020). It also has listed Chinese and Burmese entities for other human-rights abuses. 86 Fed. Reg. 13,179 (Mar. 8, 2021) ; 85 Fed. Reg. 83,416 (Dec. 22, 2020).

II

Changji Esquel Textile Co. operates a spinning mill in Xinjiang. The United States has determined that China abuses the human rights of Uyghurs and other religious or ethnic minorities in Xinjiang, including by imprisonment and forced labor. Xinjiang Supply Chain Business Advisory , 1–2 (July 13, 2021). Reports suggest that the Chinese government forcibly relocates Uyghurs to internment camps, where they are trained for low-skill work. The government also incentivizes Chinese manufacturers, especially textile and garment companies, to build factories in Xinjiang. The factories then are staffed with "graduates" from the internment camps, who work for little to no pay. Id. at 7–8.

In 2020, the Department added Changji and ten other Chinese companies to the Entity List. It stated that these entities were "implicated in human rights violations and abuses" against Uyghurs and other Muslim minority groups in Xinjiang. 85 Fed. Reg. 44,159 (July 22, 2020). Specifically, it concluded that Changji engages in "forced labor" involving members of these groups. Id. Changji disputes this finding and has petitioned the Department for relief, but it remains on the Entity List.

Changji and its parent company filed this lawsuit alleging that the Department, in adding Changji to the Entity List, violated ECRA and its implementing regulations, the APA, and the Due Process Clause. They moved for a preliminary injunction on the theory that the alleged ECRA and regulatory violations were ultra vires . The district court denied the motion on the ground that the plaintiffs are not likely to succeed on this claim. Changji Esquel Textile Co. v. Raimondo , No. 21-cv-1798, 573 F.Supp.3d 104, 116-18 (D.D.C. Nov. 4, 2021). We have jurisdiction to review this interlocutory order under 28 U.S.C. § 1292(a)(1).

III

A plaintiff seeking a preliminary injunction "must establish that he is likely to succeed on the merits, that he is likely to suffer irreparable harm in the absence of preliminary relief, that the balance of equities tips in his favor, and that an injunction is in the public interest." Winter v. NRDC, Inc. , 555 U.S. 7, 20, 129 S.Ct. 365, 172 L.Ed.2d 249 (2008). We review the denial of a preliminary injunction for abuse of discretion. Trump v. Thompson , 20 F.4th 10, 23 (D.C. Cir. 2021).

A

Although ECRA precludes APA review of the "functions exercised under this subchapter," 50 U.S.C. § 4821(a), the absence of an express cause of action "does not necessarily foreclose all judicial review," Mittleman v. Postal Regul. Comm'n , 757 F.3d 300, 307 (D.C. Cir. 2014). In particular, the plaintiff "may still be able to institute a non-statutory review action," also known as ultra vires review. Trudeau v. FTC , 456 F.3d 178, 189 (D.C. Cir. 2006) (cleaned up). The claims here, which challenge agency action under ECRA, are barred from APA review, so they must proceed under the strictures of ultra vires review. Fed. Express Corp. v. U.S. Dep't of Com. , No. 20-5337, 39 F.4th 756, 763 (D.C. Cir. July 8, 2022) ( FedEx ).

The leading Supreme Court decision on ultra vires review is Leedom v. Kyne , 358 U.S. 184, 79 S.Ct. 180, 3 L.Ed.2d 210 (1958). That case arose from an improper certification of a collective-bargaining unit—an interlocutory order excluded from the judicial-review provision of the National Labor Relations Act. See id. at 185, 187, 79 S.Ct. 180. Nonetheless, the Supreme Court held that district-court review was available because the order was "made in excess of [the agency's] delegated powers and contrary to a specific prohibition" in the NLRA. Id. at 188–89, 79 S.Ct. 180.

Time and again, courts have stressed that ultra vires review has "extremely limited scope." Griffith v. FLRA , 842 F.2d 487, 493 (D.C. Cir. 1988) ; see Bd. of Governors of Fed. Rsrv. Sys. v. MCorp Fin., Inc. , 502 U.S. 32, 43, 112 S.Ct. 459, 116 L.Ed.2d 358 (1991) ( Kyne does not "authoriz[e] judicial review of any agency action that is alleged to have exceeded the agency's statutory authority"); Boire v. Greyhound Corp. , 376 U.S. 473, 479–80, 84 S.Ct. 894, 11 L.Ed.2d 849 (1964) ( Kyne was "characterized by extraordinary circumstances"). We have described a Kyne claim as "essentially a Hail Mary pass—and in court as in football, the attempt rarely succeeds." Nyunt v. Chairman, Broad. Bd. of Governors , 589 F.3d 445, 449 (D.C. Cir. 2009).

To prevail on an ultra vires claim, the plaintiff must establish three things: "(i) the statutory preclusion of review is implied rather than express; (ii) there is no alternative procedure for review of the statutory claim; and (iii) the agency plainly acts in excess of its delegated powers and contrary to a specific prohibition in the statute that is clear and mandatory." DCH Reg'l Med. Ctr. v. Azar , 925 F.3d 503, 509 (D.C. Cir. 2019) (cleaned up). The third requirement is especially demanding. "Only error that is patently a misconstruction of the Act, that disregards a specific and unambiguous statutory directive, or that violates some specific command of a statute will support relief." FedEx , 39 F.4th at 764 (cleaned up). In other words, an agency violates a "clear and mandatory" statutory command only when the error is "so extreme that one may view it as jurisdictional or nearly so." Griffith , 842 F.2d at 493.

The plaintiffs contend that because the statute precludes only APA review, but not judicial review generally, we should relax these stringent requirements. Instead, the plaintiffs argue, we should review the government's interpretation of ECRA and its implementing regulations by simply applying traditional tools of textual analysis, as we would in considering any agency interpretation challenged through the APA. Recently, we rejected this very argument, instead holding that ultra vires review imposes the "same demanding standard for judicial intervention ... even when Congress has only withdrawn APA review, rather than cut off all statutory judicial review." FedEx , 39 F.4th at 765. And that standard requires challengers to "show more than the type of routine error in statutory interpretation or challenged findings of fact that would apply if Congress had allowed APA review" or something like it. Id. (cleaned up). For an agency interpretation of its own organic statutes, we specifically confirmed that there is "a delta between ultra vires review and less-exacting review under Chevron ." Id. at 39 F.4th at 765 ; see Chevron U.S.A., Inc. v. NRDC, Inc. , 467 U.S. 837, 104 S.Ct. 2778, 81 L.Ed.2d 694 (1984). And for an agency interpretation of its own regulations, the same reasoning compels a delta between ultra vires review and less-exacting review under Kisor v. Wilkie , ––– U.S. ––––, 139 S. Ct. 2400, 204 L.Ed.2d 841 (2019). (Following FedEx , we use the phrase "less-exacting review" to mean a standard more favorable to the challengers and less favorable to the agency.)

The plaintiffs argue that the Department, in adding Changji to the Entity List, flagrantly violated both ECRA and its own regulations. As explained below, we disagree.

B

Section 4813(a)(2) directs the Secretary to establish and maintain a list of foreign persons posing a threat to American national security and foreign policy "pursuant to the policy set forth in section 4811(2)(A)." 50 U.S.C. § 4813(a)(2). The plaintiffs understand this to mean that the Secretary may list entities only to further the policy goals set forth in section 4811(2)(A). That section flags the need to control weapons proliferation, terrorism, threatening military programs, and interference with critical infrastructure. Id. § 4811(2)(A). But it does not mention the protection of human rights, which is listed as a foreign-policy goal only in section 4811(2)(D). Thus, say the plaintiffs, the Secretary acted ultra vires in adding Changji to the Entity List based on that consideration.

This argument overlooks another important ECRA provision. Section 4813(a)(16) empowers the Secretary to "undertake any other action as is necessary to carry out this subchapter that is not otherwise prohibited by law." 50 U.S.C. § 4813(a)(16). Adding human-rights violators to the Entity List falls comfortably within this provision. By its terms, section 4811(2)(D) states that exports should be controlled to "carry out the foreign policy of the United States, including the protection of human rights and the promotion of democracy." Id. § 4811(2)(D). Actions taken to protect human rights thus "carry out this subchapter" within the meaning of section 4813(a)(16). And although section 4813(a)(2) does not independently and affirmatively authorize the Secretary to list entities for human-rights abuses, neither does it affirmatively prohibit her from doing so. At oral argument, the plaintiffs themselves conceded that ECRA would likely permit the Secretary to create a separate list of human-rights abusers. So, listing entities for human-rights abuses cannot fairly be described as "otherwise prohibited by law." 50 U.S.C. § 4813(a)(16) (emphasis added).

Our interpretive approach must also account for the substantial deference due to the Executive Branch in this context. There is a "customary policy of deference" to the Executive "in matters of foreign affairs." Jama v. ICE , 543 U.S. 335, 348, 125 S.Ct. 694, 160 L.Ed.2d 708 (2005). Likewise, we defer to Executive Branch judgments on how best to protect national security. See , e.g. , Ameziane v. Obama , 699 F.3d 488, 494 (D.C. Cir. 2012) ; CNSS v. DOJ , 331 F.3d 918, 932 (D.C. Cir. 2003). In FedEx , we recently confirmed that these principles require an additional layer of deference in reviewing administrative interpretations of statutes bearing on foreign policy and national security, which makes it even more difficult for challengers to satisfy the demanding ultra vires standard. FedEx , 39 F.4th at 769-70. Thus, we would be "hard-pressed" to set aside the Secretary's understanding of how section 4813(a)(16) interacts with the rest of ECRA. Id. at 39 F.4th at 770.

To narrow section 4813(a)(16), the plaintiffs invoke the negative-implication canon of expressio unius . They argue that because section 4813(a)(2) requires the Secretary to list entities to advance the policies noted in section 4811(2)(A), it carries a negative inference that the Secretary may not list entities for any other reason. Yet even under Chevron , we do not lightly apply the expressio unius canon. Instead, we repeatedly have described the canon as "a feeble helper in an administrative setting, where Congress is presumed to have left to reasonable agency discretion questions that it has not directly resolved." Adirondack Med. Ctr. v. Sebelius , 740 F.3d 692, 697 (D.C. Cir. 2014) (cleaned up) (collecting authority). So the canon is even more enfeebled under ultra vires review, which is more deferential to the agency than is Chevron . And even if a negative implication might occasionally establish a "clear and mandatory" prohibition, no such inference is possible here, where section 4813(a)(2) is silent on whether human-rights violators may be listed and where section 4813(a)(16) provides a separate grant of authority for doing so.

The plaintiffs also raise the specific-controls-the-general canon. They reason that section 4813(a)(2) is specific to the Entity List whereas section 4813(a)(16) is a general grant of residual authority, so the former must govern to the extent of any conflict between the two. But this canon does not apply unless the competing provisions are "irreconcilably conflicting." Adirondack , 740 F.3d at 698 (cleaned up). And sections 4813(a)(2) and 4813(a)(16) do not irreconcilably conflict on the question whether the Secretary may add human-rights abusers to the Entity List. As explained, section 4813(a)(2) is silent on the issue, and the broad grant of authority in section 4813(a)(16) allows it. No conflict arises unless section 4813(a)(2) were construed to prohibit the designation of entities for human-rights abuses by negative implication. But that is simply a rehash of the expressio unius argument, which fails for reasons explained above.

The plaintiffs similarly invoke the canon against surplusage, which disfavors construing a specific provision to be "swallowed by" a general one. RadLAX Gateway Hotel, LLC v. Amalgamated Bank , 566 U.S. 639, 645, 132 S.Ct. 2065, 182 L.Ed.2d 967 (2012). The plaintiffs contend that if section 4813(a)(16) empowered the Secretary to make additions to the Entity List, then section 4813(a)(2) ’s specific grant of authority to do so would be surplusage. But the surplusage canon "is neither inviolable nor insurmountable," particularly "when agency authority is at stake." Adirondack , 740 F.3d at 699. Here, section 4813(a)(2) specifically requires the Secretary to list entities to achieve certain specified objectives, whereas section 4813(a)(16) permits the Secretary to consider whether listing entities to achieve other specified objectives is also necessary to carry out the broader statutory scheme. Thus, each provision does meaningful, independent work, despite the possibility for partial overlap. And in any event, any latent surplusage in the Department's interpretation does not contravene a clear and mandatory prohibition in the statute.

Finally, the plaintiffs invoke the proposed United States Innovation and Competition Act of 2021, a bill recently passed by both houses of Congress and awaiting reconciliation. The bill would add "serious human rights abuses" to section 4811(2)(A), which in turn would require the Secretary to add human-rights violators to the Entity List pursuant to section 4813(a)(2). See H.R. 4521 amendment, 117th Cong. § 5211(f) (Senate bill); H.R. 4521, 117th Cong. § 30316(g) (House bill). According to the plaintiffs, if section 4813(a)(16) already allowed the Secretary to add human-rights violators to the Entity List, the proposed amendment would have no effect. However, the proposed amendment would do meaningful work by definitively resolving the interpretive dispute that the parties litigate here. Moreover, the amendment would require the Secretary to list human-rights abusers without further inquiry, whereas the existing statutory scheme merely permits the Secretary to do so based on her discretionary judgment about what is necessary to carry out ECRA. In any event, the plaintiffs’ argument depends on post-enactment legislative history, which "is not a legitimate tool of statutory interpretation" even under de novo review. Bruesewitz v. Wyeth LLC , 562 U.S. 223, 242, 131 S.Ct. 1068, 179 L.Ed.2d 1 (2011). Obviously, then, the unenacted bill cited by the plaintiffs does not give rise to a clear and mandatory legal command.

* * * *

For an agency to act ultra vires , it must transgress "clear and mandatory" limits that Congress has imposed on its authority. DCH Reg'l , 925 F.3d at 509 (cleaned up). The canons invoked by the plaintiffs can resolve statutory ambiguity in close cases, but they do not allow us to discern any clear and mandatory prohibition on adding entities to the List for human-rights abuses, particularly given the breadth of section 4813(a)(16) and the deference we owe to the Executive Branch in matters of foreign affairs. For these reasons, the plaintiffs are unlikely to succeed on their statutory claim.

C

The plaintiffs also assert that the Department acted ultra vires in violating its own regulations. We question whether regulatory violations can be the subject of ultra vires review. None of our decisions has "placed an agency's failure to follow its own regulations in the ‘ultra vires’ category." Eagle Tr. Fund v. USPS , 811 F. App'x 669, 670 (D.C. Cir. 2020). Instead, we have described ultra vires actions as ones that violate clear statutory provisions. See , e.g. , Mittleman , 757 F.3d at 307 (judicial review "is available only to determine whether the agency has acted ultra vires—that is, whether it has exceeded its statutory authority" (cleaned up)). Likewise, we have explained that for an ultra vires claim to succeed, the agency must "plainly act[ ] in excess of its delegated powers," Nyunt , 589 F.3d at 449 (cleaned up), and that its error must be "jurisdictional or nearly so," Griffith , 842 F.2d at 493. Routine regulatory violations do not plainly transgress an agency's jurisdictional limits.

Moreover, the logic of Kyne does not readily extend to regulatory claims. As explained, that case involved a non-final order that blatantly violated the NLRA. Although the order fell outside the judicial-review provisions of the NLRA and APA, the Supreme Court refused to "lightly infer" that Congress had afforded no "judicial protection of rights it confer[red] against agency action taken in excess of delegated powers." 358 U.S. at 190, 79 S.Ct. 180. Likewise, we have reasoned that "[w]hen Congress limits its delegation of power, courts infer (unless the statute clearly directs otherwise) that Congress expects this limitation to be judicially enforced." Dart v. United States , 848 F.2d 217, 223 (D.C. Cir. 1988). In other words, Congress presumably wants courts to stop agencies from ignoring specific limits that it has imposed. This reasoning does not naturally carry over to claims that an agency has violated its own rules.

In any event, even assuming that ultra vires review extends to some regulatory claims, the claim here would still fail. The plaintiffs invoke the following regulation governing which foreign parties may be added to the Entity List:

Entities for which there is reasonable cause to believe, based on specific and articulable facts, that the entity has been involved, is involved, or poses a significant risk of being or becoming involved in activities that are contrary to the national security or foreign policy interests of the United States and those acting on behalf of such entities may be added to the Entity List pursuant to this section.

15 C.F.R. § 744.11(b). In adding Changji to the Entity List, the Department stated that the company "ha[s] been implicated in human rights violations and abuses in the implementation of China's campaign of repression, mass arbitrary detention, forced labor and high-technology surveillance against Uyghurs, Kazakhs, and other members of Muslim minority groups" in Xinjiang. 85 Fed. Reg. at 44,159. "Specifically," the order went on, Changji is "engaging in activities contrary to the foreign policy interests of the United States through the practice of forced labor involving members of Muslim minority groups." Id. The plaintiffs argue that none of this shows "specific and articulable facts" to support the listing.

Ultra vires review presents no occasion to flyspeck an order's factual findings or explanation. As the Supreme Court has explained, "[t]he Kyne exception is a narrow one," which does not extend to claims that an agency has engaged in "an erroneous assessment of the particular facts" before it. Boire , 376 U.S. at 481, 84 S.Ct. 894. Similarly, we explained in Dart that ultra vires review is limited to " ‘facial’ violations" of statutes, which "typically raise issues—unrelated to the facts of the particular cases—that need only be resolved by the courts once." 848 F.2d at 222. Considering the adequacy of the agency's explanation, or the degree of support for its factual findings, would contravene these basic principles. It would also largely replicate APA-style review for substantial evidence and for arbitrariness, see 5 U.S.C. § 706(2) ; Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co. , 463 U.S. 29, 40–44, 103 S.Ct. 2856, 77 L.Ed.2d 443 (1983), despite the express statutory bar on such review.

For these reasons, the plaintiffs are unlikely to succeed on their regulatory claim.

D

Finally, the plaintiffs argue that even if they are unlikely to succeed on the merits, they are still entitled to relief because the other preliminary-injunction factors strongly favor them. In the past, this Court has applied a "sliding scale" approach under which "a strong showing on one factor could make up for a weaker showing on another." Sherley v. Sebelius , 644 F.3d 388, 392 (D.C. Cir. 2011). This approach is arguably in tension with intervening Supreme Court decisions stating without qualification that "a party seeking a preliminary injunction must demonstrate, among other things, ‘a likelihood of success on the merits.’ " Munaf v. Geren , 553 U.S. 674, 690, 128 S.Ct. 2207, 171 L.Ed.2d 1 (2008) (citation omitted); see also Winter , 555 U.S. at 20, 129 S.Ct. 365. In the past, we have noted this tension but reserved the question whether the sliding-scale approach remains valid. Archdiocese of Wash. v. WMATA , 897 F.3d 314, 334 (D.C. Cir. 2018). We follow the same approach here because, even under the sliding-scale approach, the movant must raise at least a "serious legal question on the merits." Sherley , 644 F.3d at 398 (cleaned up). For the reasons given above, the plaintiffs have failed to do so.

IV

The plaintiffs threw "a Hail Mary pass," Nyunt , 589 F.3d at 449, and like many other litigants pressing ultra vires claims, they have come up short. We affirm the denial of a preliminary injunction.

So ordered.