diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6401bd6..bddae5e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,6 +25,19 @@ updates:
         update-types:
           - minor
           - patch
+    ignore:
+      # `windows` is not ours to pick. tauri-runtime's WindowBuilder trait
+      # takes windows::Win32::Foundation::HWND in owner() and parent(), so
+      # our copy has to be the crate version tauri-runtime resolves: two
+      # semver-incompatible `windows` in the graph are two distinct HWND
+      # types, and the impl stops matching the trait (E0053). tauri-runtime
+      # 2.11.3 requires ^0.61, so 0.61.x is the whole usable range, and the
+      # move to 0.62 arrives as a tauri-runtime bump rather than this one.
+      # Patch updates inside 0.61 still unify, so those are left open.
+      - dependency-name: windows
+        update-types:
+          - version-update:semver-minor
+          - version-update:semver-major
 
   - package-ecosystem: github-actions
     directory: "/"
@@ -36,3 +49,13 @@ updates:
           - major
           - minor
           - patch
+    ignore:
+      # dtolnay/rust-toolchain's refs are Rust versions rather than releases
+      # of the action, and the repository carries branches for versions that
+      # rustup cannot install yet — 1.99.0 and 1.100.0 are both there while
+      # stable is 1.98.0 — so the numerically highest ref is a 404 from
+      # static.rust-lang.org. Which toolchain CI installs is settled by
+      # rust-toolchain.toml anyway, and the action takes the version at the
+      # call site rather than from that file, so the two are moved together
+      # by hand — see the note there.
+      - dependency-name: dtolnay/rust-toolchain
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 740bed1..c5c9d22 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: .github/scripts/check-patch-series.sh
 
   build:
@@ -51,7 +51,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Servo's repository contains WPT test paths longer than Windows'
       # legacy MAX_PATH; without longpaths, cargo's checkout of the servo
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cbe4692..20b1a97 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -40,7 +40,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Servo's repository contains WPT test paths longer than Windows'
       # legacy MAX_PATH; see the note in ci.yml.
@@ -86,7 +86,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: install Rust
         uses: dtolnay/rust-toolchain@1.95.0
diff --git a/Cargo.toml b/Cargo.toml
index 1cd4f9d..301c4c7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,6 +68,12 @@ log = "0.4.21"
 softbuffer = { version = "0.4", default-features = false }
 once_cell = "1.20"
 
+# Pinned to whatever tauri-runtime resolves, not to the newest release: its
+# WindowBuilder trait takes windows::Win32::Foundation::HWND in owner() and
+# parent(), and a second, semver-incompatible `windows` in the graph makes
+# that a different type from the one this crate's impl uses. tauri-runtime
+# 2.11.3 requires ^0.61; .github/dependabot.yml keeps bumps off it for the
+# same reason.
 [target."cfg(windows)".dependencies.windows]
 version = "0.61"
 features = [