diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8d98d46..f232813 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ env:
     --remap-path-prefix /home/runner/work=src
     --remap-path-prefix /home/runner/.cargo/registry/src=crate
     --remap-path-prefix /home/runner/.rustup=rustup
-  RUST_TOOLCHAIN: "1.82"
+  RUST_TOOLCHAIN: "1.88"
   SOURCE_DATE_EPOCH: "0"
   CARGO_INCREMENTAL: "0"
 
@@ -64,7 +64,7 @@ jobs:
         run: dnf install -y gcc make curl
       - name: Install build deps (openSUSE)
         if: matrix.os == 'opensuse'
-        run: zypper install -y gcc make curl gzip tar
+        run: zypper install -y gcc make curl gzip tar xz
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
@@ -136,7 +136,7 @@ jobs:
             setup: "dnf install -y gcc make curl fuse-overlayfs fuse3 crun"
           - os: opensuse
             container: opensuse/tumbleweed:latest
-            setup: "zypper install -y gcc make curl fuse-overlayfs gzip tar crun"
+            setup: "zypper install -y gcc make curl fuse-overlayfs gzip tar xz crun"
     container: ${{ matrix.container }}
     steps:
       - uses: actions/checkout@v4
@@ -510,14 +510,8 @@ jobs:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
       - name: Verify Cargo.lock is up-to-date
         run: |
-          cp Cargo.lock /tmp/Cargo.lock.before
-          cargo update
-          if ! diff -u /tmp/Cargo.lock.before Cargo.lock; then
-            echo "FATAL: Cargo.lock is not up-to-date or has drifted"
-            echo "Run 'cargo update' locally and commit the result"
-            exit 1
-          fi
-          echo "Cargo.lock integrity: OK (no drift detected)"
+          cargo check --workspace --locked
+          echo "Cargo.lock integrity: OK (lockfile consistent with Cargo.toml)"
 
   cargo-deny:
     name: Dependency Policy (cargo-deny)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55ab31f..118469a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ env:
     --remap-path-prefix /home/runner/work=src
     --remap-path-prefix /home/runner/.cargo/registry/src=crate
     --remap-path-prefix /home/runner/.rustup=rustup
-  RUST_TOOLCHAIN: "1.82"
+  RUST_TOOLCHAIN: "1.88"
   SOURCE_DATE_EPOCH: "0"
   CARGO_INCREMENTAL: "0"
 
diff --git a/.github/workflows/supply-chain-test.yml b/.github/workflows/supply-chain-test.yml
index 10d3d37..0869696 100644
--- a/.github/workflows/supply-chain-test.yml
+++ b/.github/workflows/supply-chain-test.yml
@@ -13,7 +13,7 @@ env:
     --remap-path-prefix /home/runner/work=src
     --remap-path-prefix /home/runner/.cargo/registry/src=crate
     --remap-path-prefix /home/runner/.rustup=rustup
-  RUST_TOOLCHAIN: "1.82"
+  RUST_TOOLCHAIN: "1.88"
   SOURCE_DATE_EPOCH: "0"
   CARGO_INCREMENTAL: "0"