diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 722bcd3..cd258f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,15 +73,14 @@ jobs:
   # accumulate silently.
   audit:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      checks: write
     steps:
       - uses: actions/checkout@v5
-      - uses: rustsec/audit-check@v1.4.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@stable
+      # Run cargo audit directly rather than rustsec/audit-check, which is
+      # pinned to the deprecated Node 20 runtime (it has no Node 24 release).
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - run: cargo audit
 
   # I55 (ISSUES.md, 2026-05-22): pin MSRV in CI. Cargo.toml declares
   # rust-version = "1.82" (the floor stabilized by Option::is_none_or in
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 2557471..5f7c8b2 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -48,7 +48,7 @@ jobs:
           targets: aarch64-apple-darwin, x86_64-apple-darwin
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.19
+        uses: pypa/cibuildwheel@v3.4.1
         env:
           CIBW_BUILD: "cp311-* cp312-* cp313-*"
           CIBW_SKIP: "*-musllinux_*"
@@ -68,6 +68,11 @@ jobs:
           CIBW_BEFORE_BUILD: "pip install maturin"
           CIBW_BEFORE_ALL_LINUX: "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal"
           CIBW_ENVIRONMENT_LINUX: 'PATH="$HOME/.cargo/bin:$PATH"'
+          # Pin the manylinux image (broad glibc-2.17 compat) so the
+          # cibuildwheel v3 bump does not shift the Linux wheels' glibc
+          # floor. 64-bit only, so the i686 libatomic issue does not apply.
+          CIBW_MANYLINUX_X86_64_IMAGE: manylinux2014
+          CIBW_MANYLINUX_AARCH64_IMAGE: manylinux2014
           CIBW_TEST_REQUIRES: "pytest hypothesis"
           CIBW_TEST_COMMAND: "pytest {package}/tests"
         with: