diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30a8b69..ad90ac5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
         run: cargo test --locked --release --test bench -- --ignored --nocapture
 
   msrv:
-    name: msrv (1.87)
+    name: msrv (1.91)
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -107,7 +107,7 @@ jobs:
           persist-credentials: false
 
       - name: Install the rust-version toolchain
-        run: rustup toolchain install 1.87 --profile minimal
+        run: rustup toolchain install 1.91 --profile minimal
 
       - name: Build on rust-version
-        run: cargo +1.87 check --locked --all-targets
+        run: cargo +1.91 check --locked --all-targets
diff --git a/Cargo.toml b/Cargo.toml
index 05a1973..86357d5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,9 +5,10 @@ edition = "2021"
 description = "Command-line client for CacheKit"
 license = "MIT"
 repository = "https://github.com/cachekit-io/cachekit-cli"
-# 1.87: blake2 0.11 pulls in ctutils, and its fix for RUSTSEC-2026-0385
-# (0.4.4 and later) needs 1.87.
-rust-version = "1.87"
+# New releases support the latest stable Rust. rust-version is the oldest
+# toolchain CI checks (the msrv job); when a dependency needs a newer one,
+# raise both instead of holding the dependency back.
+rust-version = "1.91"
 # Resolve dependency versions that build on rust-version, so the lockfile
 # keeps the MSRV promise that CI checks.
 resolver = "3"