diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index fbcb020..b1b44bc 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -41,10 +41,10 @@ jobs:
       - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           # update `cargo-expand` accordingly, when bumping MSRV:
-          toolchain: 1.88.0
+          toolchain: 1.91.0
           components: rust-src
       - uses: cargo-bins/cargo-binstall@dc19f1e48450eefe5a29b8da6c6b00a87d730b37 # v1.18.1
-      - run: cargo binstall cargo-expand@1.0.95 --no-confirm
+      - run: cargo binstall cargo-expand@1.0.121 --no-confirm
       - run: cargo test -- --test-threads=1
 
   fmt:
diff --git a/renovate.json b/renovate.json
index c8b5492..a15e270 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,49 +1,45 @@
 {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": ["config:recommended"],
+    "extends": ["config:best-practices"],
     "packageRules": [
         {
-            "allowedVersions": "!/^=/",
-            "matchDepTypes": ["dependencies", "dev-dependencies"],
-            "matchPackageNames": ["*"],
-            "description": "only match non-pinned versions"
-        },
-        {
-            "matchDepTypes": ["dependencies", "dev-dependencies"],
-            "matchUpdateTypes": ["major"],
-            "matchPackageNames": ["*"],
-            "description": "create separate PRs for major upgrades"
+            "description": "skip cargo deps that are explicitly pinned with '='",
+            "matchDepTypes": ["dependencies", "dev-dependencies", "build-dependencies"],
+            "allowedVersions": "!/^=/"
         },
         {
+            "description": "group non-major dependency upgrades",
             "groupName": "dependencies",
             "groupSlug": "dependencies",
             "matchDepTypes": ["dependencies"],
-            "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
-            "matchPackageNames": ["*"],
-            "description": "create grouped PRs for non-major dependency upgrades"
+            "matchUpdateTypes": ["minor", "patch", "pin", "digest"]
         },
         {
+            "description": "group non-major dev-dependency upgrades",
             "groupName": "dev-dependencies",
             "groupSlug": "dev-dependencies",
             "matchDepTypes": ["dev-dependencies"],
-            "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
-            "matchPackageNames": ["*"],
-            "description": "create grouped PRs for non-major dev-dependency upgrades"
+            "matchUpdateTypes": ["minor", "patch", "pin", "digest"]
         },
         {
-            "extends": ["schedule:automergeMonthly"],
+            "description": "upgrade cargo-binstall monthly and auto-merge after a 14-day release-age buffer",
+            "extends": ["schedule:monthly"],
             "groupName": "cargo-binstall",
             "groupSlug": "cargo-binstall",
             "matchPackageNames": ["cargo-binstall"],
+            "minimumReleaseAge": "14 days",
             "automerge": true,
-            "description": "upgrade once a month and auto-merge"
+            "automergeType": "branch"
         },
         {
+            "description": "batch github actions monthly and silently auto-merge after a 14-day release-age buffer",
+            "extends": ["schedule:monthly"],
             "groupName": "github actions",
             "groupSlug": "github-actions",
-            "matchDepTypes": ["action"],
-            "pinDigests": true,
-            "description": "always pin github actions"
+            "matchManagers": ["github-actions"],
+            "minimumReleaseAge": "14 days",
+            "automerge": true,
+            "automergeType": "branch"
         }
     ]
 }