diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7f56320..48e72cd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,3 +12,7 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    ignore:
+      # The versioned ref tests our MSRV; @stable jobs track the latest compiler.
+      # Raise the MSRV deliberately alongside Cargo.toml's rust-version.
+      - dependency-name: dtolnay/rust-toolchain
diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index f3e797e..d85ecc1 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -1,6 +1,9 @@
 name: Build and Run
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
 
 permissions:
   contents: read
@@ -78,6 +81,7 @@ jobs:
     steps:
     
     - uses: actions/checkout@v7
+    # Keep pinned to Cargo.toml's rust-version; rust-stable tests the latest Rust.
     - uses: dtolnay/rust-toolchain@1.88.0
 
     - name: Build & Test
diff --git a/.github/workflows/advisories.yml b/.github/workflows/advisories.yml
index 6aa1db6..93585ba 100644
--- a/.github/workflows/advisories.yml
+++ b/.github/workflows/advisories.yml
@@ -2,6 +2,7 @@ name: Dependency advisories
 
 on:
   push:
+    branches: [main]
   pull_request:
   schedule:
     - cron: '23 6 * * *'
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 7e15833..f59426b 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -2,6 +2,7 @@ name: Bounded fuzzing
 
 on:
   push:
+    branches: [main]
   pull_request:
   schedule:
     - cron: '41 6 * * 1'
diff --git a/TESTING.md b/TESTING.md
index ea9aadf..29e5ffd 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -89,22 +89,25 @@ their normal package manager as described above.
 ## Platform coverage
 
 The minimum supported Rust version is **1.88.0**, declared as `rust-version = "1.88"`
-in `Cargo.toml`. CI runs the Rust build and tests on Linux
-and Windows, checks Rust 1.88.0 on Linux, and runs the Clevis compatibility tests
-in a separate Linux job.
+in `Cargo.toml`. CI runs the Rust build and tests on the latest stable compiler
+on Linux and Windows, checks Rust 1.88.0 on Linux, and runs the Clevis compatibility
+tests in a separate Linux job. The stable jobs follow new Rust releases
+automatically. Dependabot ignores `dtolnay/rust-toolchain` updates so the MSRV job
+stays pinned; raise it deliberately alongside `Cargo.toml`'s `rust-version`.
 
 Other Unix platforms have no CI coverage. See [key storage and rotation](KEY_STORAGE.md)
 for platform permission and crash-durability differences.
 
 ## Release checks and fuzzing
 
-CI requires formatting, strict Clippy, compilation, release builds, tests and
+CI runs on pull requests and pushes to `main`, avoiding duplicate runs for PR
+branch pushes. It requires formatting, strict Clippy, compilation, release builds, tests and
 Rust 1.88.0 checks, retaining Linux, Windows and Clevis jobs. The assurance job
 checks the combined platform reports; a local Linux run alone cannot establish
 Windows behavior. Repository maintainers must select these jobs as required
 status checks in GitHub branch protection to enforce them before merging.
 
-Dependency advisories are checked on pushes, pull requests and a daily schedule
+Dependency advisories are checked on pushes to `main`, pull requests and a daily schedule
 with a freshly fetched RustSec database. Both the library and fuzz lockfiles are
 scanned, and warnings fail the check. Dependabot monitors Cargo dependencies
 (including fuzz tooling) and GitHub Actions weekly. To run the advisory checks:
@@ -116,7 +119,7 @@ cargo audit --file fuzz/Cargo.lock --deny warnings
 ```
 
 Two bounded, seeded fuzz targets exercise recovery request parsing and JWK
-conversion on pull requests, pushes and weekly runs. They run on nightly Rust
+conversion on pull requests, pushes to `main` and weekly runs. They run on nightly Rust
 with AddressSanitizer, separately from the library's stable/MSRV builds. See
 [fuzz/README.md](fuzz/README.md) for commands, resource bounds, seed provenance
 and crash reproduction. A bounded run is a regression check, not exhaustive