diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 94d0ce3..6ffac69 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,11 +20,11 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
   # Pinned explicitly instead of `stable` so a tag built months from now uses the
-  # same compiler that was tested. 1.98.1 is current stable (it is also the Rust
-  # that ships on GitHub's runner images) and sits well above the
-  # `rust-version = "1.88"` MSRV floor declared in Cargo.toml. Quoted so YAML
-  # cannot read it as a number.
-  RUST_TOOLCHAIN_VERSION: "1.98.1"
+  # same compiler that was tested. 1.99.0 is current stable, and it is the
+  # `rust-version = "1.99.0"` MSRV floor declared in Cargo.toml, so the release
+  # builds with the oldest compiler the crate supports. Quoted so YAML cannot
+  # read it as a number.
+  RUST_TOOLCHAIN_VERSION: "1.99.0"
 
 jobs:
   validate-release-source:
diff --git a/Cargo.toml b/Cargo.toml
index 0c44ddb..6a44b82 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,7 +2,7 @@
 name = "selfhost-cli"
 version = "0.3.0"
 edition = "2024"
-rust-version = "1.88"
+rust-version = "1.99.0"
 description = "The SelfHost platform CLI"
 license = "Apache-2.0"
 publish = false
diff --git a/README.md b/README.md
index 1fa3b1f..8255720 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ Delete the binary and, on Windows, drop the install directory from your user PAT
 
 ### Building from source
 
-You need Rust 1.88 or newer.
+You need Rust 1.99.0 or newer.
 
 ```sh
 cargo build
diff --git a/skills/selfhostdev/SKILL.md b/skills/selfhostdev/SKILL.md
index f6b98b8..b4902f6 100644
--- a/skills/selfhostdev/SKILL.md
+++ b/skills/selfhostdev/SKILL.md
@@ -27,7 +27,7 @@ platform endpoint the typed commands do not cover yet.
 ## Setup
 
 Build the binary from the project's repository
-(github.com/selfhost-dev/selfhost-cli, Rust 1.88+), put it on `PATH`, then sign
+(github.com/selfhost-dev/selfhost-cli, Rust 1.99.0+), put it on `PATH`, then sign
 in once per profile. The CLI stores the credentials and renews them over HTTPS
 without a browser, so a machine signed in once keeps working unattended.