diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6dc3d86..8b93711 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,6 +13,20 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    # Some crates only work version-aligned, so they must be proposed as one
+    # PR. Ungrouped, Dependabot bumped opentelemetry_sdk 0.27 -> 0.32 alone
+    # (#110) while its three siblings stayed on 0.27; the crate stopped
+    # compiling and DB Checks went red. Group families here rather than
+    # relying on review to catch the split.
+    groups:
+      opentelemetry:
+        patterns:
+          - "opentelemetry*"
+          - "tracing-opentelemetry"
+      tower:
+        patterns:
+          - "tower"
+          - "tower-http"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index 2668ec3..8c2886c 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -23,7 +23,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - name: Install Rust toolchain
+        # `toolchain:` is mandatory when this action is pinned to a SHA — see
+        # the note in stress-test.yml. This SHA currently tolerates its absence;
+        # stating it explicitly keeps the step working across future re-pins.
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: stable
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
       - name: Run cargo audit
diff --git a/.github/workflows/db-checks.yml b/.github/workflows/db-checks.yml
index 027e7bc..c2c2ced 100644
--- a/.github/workflows/db-checks.yml
+++ b/.github/workflows/db-checks.yml
@@ -39,7 +39,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
+        # `toolchain:` is mandatory when this action is pinned to a SHA — see
+        # the note in stress-test.yml. This SHA currently tolerates its absence;
+        # stating it explicitly keeps the step working across future re-pins.
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: stable
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e7e4bc0..1ca7814 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,8 +46,12 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Rust toolchain
+        # `toolchain:` is mandatory when this action is pinned to a SHA — see
+        # the note in stress-test.yml. Supplying `targets:` alone does not
+        # satisfy it.
         uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable
         with:
+          toolchain: stable
           targets: ${{ matrix.target }}
       - name: Install cross-compilation tools
         if: matrix.target == 'aarch64-unknown-linux-gnu'
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index 92999ef..a3d8776 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -12,7 +12,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - name: Install Rust toolchain
+        # `toolchain:` is mandatory when this action is pinned to a SHA: it
+        # normally infers the toolchain from the ref that called it (@stable ->
+        # "stable"), and a SHA carries no such name. Without it the action fails
+        # with `error: invalid toolchain name ''`.
         uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable 1.91
+        with:
+          toolchain: stable
 
       - name: Install stress testing tools
         run: |
diff --git a/Cargo.lock b/Cargo.lock
index 080e704..82c719d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2605,6 +2605,7 @@ dependencies = [
  "thiserror",
  "tokio",
  "tokio-stream",
+ "tracing",
 ]
 
 [[package]]
@@ -2831,12 +2832,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "portable-atomic"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
-
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -4475,7 +4470,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adbc64cba7137545b8044cb1fe9814f7aacf3c6b5f9b45be8bb5db538befdb26"
 dependencies = [
  "js-sys",
+ "once_cell",
  "opentelemetry",
+ "opentelemetry_sdk",
  "smallvec",
  "tracing",
  "tracing-core",
diff --git a/benches/echidnabot_bench.rs b/benches/echidnabot_bench.rs
index 1a29037..6a2da65 100644
--- a/benches/echidnabot_bench.rs
+++ b/benches/echidnabot_bench.rs
@@ -13,13 +13,16 @@
 //! Run locally: `cargo bench`
 //! Compare: `cargo bench -- --save-baseline main` then `cargo bench -- --baseline main`
 
-use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
 use echidnabot::api::rate_limit::WebhookRateLimiter;
 use echidnabot::dispatcher::ProverKind;
 use echidnabot::scheduler::ProofJob;
 use echidnabot::store::models::goal_fingerprint;
 use hmac::{Hmac, Mac};
 use sha2::Sha256;
+// criterion 0.8 deprecated its own `black_box` re-export in favour of the std
+// one; CI runs clippy with `-D warnings`, so the re-export is an error here.
+use std::hint::black_box;
 use std::net::{IpAddr, Ipv4Addr};
 use uuid::Uuid;