diff --git a/.github/workflows/security_audit.yaml b/.github/workflows/security_audit.yaml
index 070c7de..13d844f 100644
--- a/.github/workflows/security_audit.yaml
+++ b/.github/workflows/security_audit.yaml
@@ -24,6 +24,19 @@ jobs:
           persist-credentials: false
           token: ${{ secrets.GITHUB_TOKEN }}
 
+      # rustsec/audit-check looks for `cargo-audit` on PATH and falls back to a
+      # bare `cargo install cargo-audit` when it is missing. That fallback
+      # passes no `--locked`, so it resolves cargo-audit's dependencies fresh
+      # and pulls in whatever versions are current, several of which now
+      # require a newer rustc than the 1.95.0 that rust-toolchain.toml pins for
+      # this repository. Installing a prebuilt binary first satisfies the PATH
+      # lookup, so the action never compiles cargo-audit and the pin no longer
+      # constrains a tool that only ever reads Cargo.lock.
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@97a5807a604e12de3a13b52d868ebecaeeea757c # v2.75.4
+        with:
+          tool: cargo-audit
+
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/Cargo.lock b/Cargo.lock
index 5832876..7b7a9a7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
@@ -351,9 +351,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.16"
+version = "0.4.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
+checksum = "ca71a6a1a566e01ad6b3b87edcbf9bd3374c27e31978c1b4e38c9fa6412557d2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -550,9 +550,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.54"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
  "num-conv",