diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8842547e..d391c52f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
@@ -70,7 +70,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       - uses: Swatinem/rust-cache@v2
       - name: cargo test
         # Valkey/testcontainers integration tests are `#[ignore]`d by default
@@ -87,7 +87,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       - name: Install Go
         uses: actions/setup-go@v5
         with:
@@ -108,7 +108,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       # NOTE: intentionally NO Swatinem/rust-cache here, AND we wipe the registry
       # index before packaging. The committed Cargo.lock is byte-identical to a
       # fresh x86_64 resolution (verified in an amd64 container), so the lock is
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 5232f582..862e478e 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: llvm-tools-preview
       - uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/release-ffi.yaml b/.github/workflows/release-ffi.yaml
index ebcb50d6..67523072 100644
--- a/.github/workflows/release-ffi.yaml
+++ b/.github/workflows/release-ffi.yaml
@@ -69,7 +69,7 @@ jobs:
         # so the cross (musl) target ends up missing on the toolchain actually
         # used (E0463: can't find crate for `core`). Pinning installs the
         # target onto 1.96.0 directly. Mirrors the other workflows.
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
         with:
           targets: ${{ matrix.target }}
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a946e39f..f4d72662 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       - name: Check tag == workspace version
         if: github.event_name == 'push'
         env:
@@ -58,7 +58,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --workspace
 
@@ -69,7 +69,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       # NOTE: intentionally NO Swatinem/rust-cache here. A restored partial
       # `~/.cargo/registry` index makes `cargo package/publish --locked` abort
       # with "cannot update the lock file" against the sparse index even when
diff --git a/.github/workflows/supply-chain.yaml b/.github/workflows/supply-chain.yaml
index 2afa071c..3783a0df 100644
--- a/.github/workflows/supply-chain.yaml
+++ b/.github/workflows/supply-chain.yaml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       - uses: Swatinem/rust-cache@v2
       - name: Install cargo-deny
         run: cargo install cargo-deny --locked
diff --git a/.github/workflows/tutorial.yaml b/.github/workflows/tutorial.yaml
index 79420bd7..ca193e42 100644
--- a/.github/workflows/tutorial.yaml
+++ b/.github/workflows/tutorial.yaml
@@ -32,7 +32,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: Install Rust 1.96.0
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
       - uses: Swatinem/rust-cache@v2
       # `make tutorial-check` brings the Keycloak compose stack up, runs the
       # no-IdP and IdP-backed module checks, then tears the stack down.