diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2f9ca61..14303e5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -31,6 +31,12 @@ updates:
     groups:
       github-actions:
         patterns: ["*"]
+    ignore:
+      # dtolnay/rust-toolchain uses the @ref as the Rust version to install,
+      # not as a semver action release. @stable always resolves to latest stable
+      # (no update needed), and @1.85 is our intentional MSRV pin (must only
+      # change when we deliberately raise the MSRV — not via Dependabot).
+      - dependency-name: "dtolnay/rust-toolchain"
 
   # Dev container features — updates feature versions in devcontainer.json and
   # regenerates devcontainer-lock.json with fresh digests.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2308071..aa869d7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
       # Preserve ANSI colour codes in cargo output for readable Actions logs.
       CARGO_TERM_COLOR: always
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
         # dtolnay/rust-toolchain reads rust-toolchain.toml automatically,
         # so the channel, components, and profile are sourced from that file.
@@ -66,7 +66,7 @@ jobs:
         # Upload the generated HTML docs as a workflow artifact (viewable in the
         # Actions UI; kept for 7 days to avoid burning the default 90-day quota).
       - name: upload docs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: docs
           path: target/doc
@@ -88,7 +88,7 @@ jobs:
     env:
       CARGO_TERM_COLOR: always
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: dtolnay/rust-toolchain@1.85