diff --git a/Cargo.lock b/Cargo.lock
index d4a8916..5a478c6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -223,15 +223,6 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
-[[package]]
-name = "bit-vec"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "bitflags"
 version = "2.13.0"
@@ -484,9 +475,9 @@ dependencies = [
 
 [[package]]
 name = "dimpl"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a11091ebc139b18d6b5878d8769ca43ad5ea8a7e2f5ed1e1f25e172951ef0ce"
+checksum = "bb2b8390bf0021eae92cf96a0e3a54c531b6315c47edfe9220f5fc61bc9e1f63"
 dependencies = [
  "aes",
  "arrayvec",
@@ -1304,9 +1295,9 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.14.8"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
+checksum = "10b99e0098aa4082912d4c649628623db6aba77335e4f4569ff5083a6448b32e"
 dependencies = [
  "aws-lc-rs",
  "rustls-pki-types",
@@ -2538,11 +2529,10 @@ dependencies = [
 
 [[package]]
 name = "yasna"
-version = "0.6.0"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
 dependencies = [
- "bit-vec",
  "time",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index ed85cdd..572c7d0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -71,3 +71,10 @@ reqwest = { version = "0.12", default-features = false, features = ["json", "rus
 # (crates/rutster-sim/scenarios/*.toml). The first consumer of `toml` in
 # the workspace; declared here so future members share the version pin.
 toml = "0.8"
+# rcgen NOTE: rcgen 0.14.8 bumped MSRV to Rust 1.88, breaking the 1.85
+# toolchain matrix. rcgen is a transitive dep via dimpl → str0m 0.21 →
+# rutster-media. Cargo.lock pins it to 0.14.7 (the minimum satisfying
+# dimpl's ^0.14.7 constraint) to keep the 1.85 MSRV safety net. If a
+# `cargo update` bumps it past 0.14.7, the 1.85 CI job will fail — re-pin
+# with `cargo update -p rcgen --precise 0.14.7`. When the project bumps
+# rust-toolchain.toml past 1.88, this pin can be dropped.