diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8ae9df08..0f476bcb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,12 +7,23 @@
 
 version: 2
 updates:
+  # All Rust/Cargo directories are grouped into a single entry so that
+  # when a dependency is updated, Dependabot creates ONE PR that bumps it
+  # across the root workspace AND every binding, preventing version skew.
   - package-ecosystem: "cargo"
-    directory: "/" # Location of package manifests
+    directories:
+      - "/"
+      - "/bindings/ffi"
+      - "/bindings/java"
+      - "/bindings/python"
+      - "/bindings/ruby"
+      - "/bindings/wasm"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
-      per-dependency:
+      rust-dependencies:
         patterns:
           - "*"
     # Ignore vendored mimalloc crates; updates are managed manually.
@@ -20,82 +31,12 @@ updates:
       - dependency-name: "regorus-mimalloc"
       - dependency-name: "regorus-mimalloc-sys"
 
-  - package-ecosystem: "cargo"
-    directory: "/bindings/ffi"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/java"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/python"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/ruby"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/ruby/ext/regorusrb"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/wasm"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/tests/ensure_no_std"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/xtask"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
   - package-ecosystem: "gomod"
     directory: "/bindings/go"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -105,6 +46,8 @@ updates:
     directory: "/bindings/java"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -114,6 +57,8 @@ updates:
     directory: "/bindings/csharp"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -123,6 +68,8 @@ updates:
     directory: "/bindings/python"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -132,6 +79,8 @@ updates:
     directory: "/bindings/ruby"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -141,7 +90,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "ci(deps)"
     groups:
-      per-dependency:
+      github-actions:
         patterns:
           - "*"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 60f04690..d7bd4acf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -69,7 +69,7 @@ jobs:
       uses: ./.github/actions/toolchains/rust
 
     - name: Cache cargo
-      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
         shared-key: ${{ runner.os }}-regorus
 
@@ -99,13 +99,13 @@ jobs:
 
     - name: Setup Go
       if: matrix.language == 'go'
-      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
       with:
         go-version: '1.21'
 
     - name: Setup .NET
       if: matrix.language == 'csharp'
-      uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
       with:
         global-json-file: ./bindings/csharp/global.json
 
@@ -115,12 +115,12 @@ jobs:
 
     - name: Setup Node.js
       if: matrix.language == 'javascript-typescript'
-      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version: '18'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -141,7 +141,7 @@ jobs:
 
     - name: Setup Ruby
       if: matrix.language == 'rust' && contains(matrix.working-directory, 'ruby')
-      uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+      uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
       with:
         ruby-version: '3.4.2'
         bundler-cache: true
@@ -188,6 +188,6 @@ jobs:
       run: cargo xtask build-wasm --release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
       with:
         category: "/language:${{matrix.language}}"
\ No newline at end of file
diff --git a/.github/workflows/dependabot-refresh-cargo-lockfiles.yml b/.github/workflows/dependabot-refresh-cargo-lockfiles.yml
new file mode 100644
index 00000000..4bdbae33
--- /dev/null
+++ b/.github/workflows/dependabot-refresh-cargo-lockfiles.yml
@@ -0,0 +1,107 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+#
+name: dependabot/refresh-cargo-lockfiles
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches: ["main"]
+
+permissions:
+  contents: write
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  refresh-cargo-lockfiles:
+    if: >-
+      github.actor == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        ref: ${{ github.event.pull_request.head.ref }}
+        fetch-depth: 0
+
+    - name: Setup Rust toolchain
+      run: |
+        rustup override set 1.92.0
+        cargo --version
+        rustc --version
+
+    - name: Refresh affected Cargo lockfiles
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        base_sha="${{ github.event.pull_request.base.sha }}"
+        head_sha="${{ github.event.pull_request.head.sha }}"
+
+        mapfile -t changed_files < <(git diff --name-only "$base_sha" "$head_sha" -- '**/Cargo.toml' '**/Cargo.lock')
+
+        if [ "${#changed_files[@]}" -eq 0 ]; then
+          echo "No Cargo manifest or lockfile changes detected."
+          exit 0
+        fi
+
+        declare -A manifests=()
+        for path in "${changed_files[@]}"; do
+          case "$path" in
+            bindings/ffi/*)
+              manifests["bindings/ffi/Cargo.toml"]=1
+              ;;
+            bindings/java/*)
+              manifests["bindings/java/Cargo.toml"]=1
+              ;;
+            bindings/python/*)
+              manifests["bindings/python/Cargo.toml"]=1
+              ;;
+            bindings/ruby/*)
+              manifests["bindings/ruby/Cargo.toml"]=1
+              ;;
+            bindings/wasm/*)
+              manifests["bindings/wasm/Cargo.toml"]=1
+              ;;
+            *)
+              manifests["Cargo.toml"]=1
+              ;;
+          esac
+        done
+
+        for manifest in "${!manifests[@]}"; do
+          echo "Refreshing lockfile for $manifest"
+          cargo metadata --format-version 1 --all-features --manifest-path "$manifest" > /dev/null
+        done
+
+        if [[ -n "${manifests[Cargo.toml]+x}" ]]; then
+          echo "Refreshing lockfile for tests/ensure_no_std/Cargo.toml (thumbv7m-none-eabi)"
+          cargo metadata --format-version 1 \
+            --manifest-path tests/ensure_no_std/Cargo.toml \
+            --filter-platform thumbv7m-none-eabi > /dev/null
+        fi
+
+    - name: Commit lockfile refresh
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        git add Cargo.lock \
+          bindings/ffi/Cargo.lock \
+          bindings/java/Cargo.lock \
+          bindings/python/Cargo.lock \
+          bindings/ruby/Cargo.lock \
+          bindings/wasm/Cargo.lock
+
+        if git diff --cached --quiet; then
+          echo "No Cargo lockfile changes required."
+          exit 0
+        fi
+
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git commit -m "build(deps): refresh Cargo lockfiles"
+        git push
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 69ce5516..efa7df0c 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -27,7 +27,7 @@ jobs:
           - bindings/wasm/Cargo.lock
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run cargo audit
         uses: rustsec/audit-check@v2
@@ -53,7 +53,7 @@ jobs:
           - xtask/Cargo.toml
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: ./.github/actions/toolchains/rust
diff --git a/.github/workflows/feature-matrix.yml b/.github/workflows/feature-matrix.yml
new file mode 100644
index 00000000..6e96dc1f
--- /dev/null
+++ b/.github/workflows/feature-matrix.yml
@@ -0,0 +1,82 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+#
+# Thorough weekly test of non-default feature combinations.
+# Catches regressions from dependency updates and feature-gating issues
+# that the fast PR CI checks (cargo check only) would miss at runtime.
+name: tests/feature-matrix
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run at 3:42 AM UTC every Saturday.
+    - cron: "42 3 * * 6"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  feature-matrix:
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Bare minimum: validates that the core interpreter works
+          # without any builtins or optional subsystems.
+          - name: minimal (std + arc)
+            features: std,arc
+
+          # Common library usage pattern (issue #595): consumer enables
+          # std + arc + rvm and relies on indexmap/std propagation.
+          - name: library (std + arc + rvm)
+            features: std,arc,rvm
+
+          # New default after removing mimalloc from full-opa.
+          # Ensures all builtins compile without the allocator.
+          - name: full-opa (no mimalloc)
+            features: std,arc,full-opa
+
+          # Binding-style usage: full-opa with the vendored allocator.
+          # Mirrors how ffi/java/python/ruby bindings are built.
+          - name: full-opa + allocator
+            features: std,arc,full-opa,allocator-memory-limits
+
+          # Selective builtins without full-opa: validates that popular
+          # features can be cherry-picked independently.
+          - name: cherry-picked builtins
+            features: std,arc,rvm,regex,time,semver,cache
+
+          # Observability features only: coverage + cache without the
+          # heavier builtins (regex, time, etc.).
+          - name: observability
+            features: std,arc,rvm,coverage,cache
+
+          # Azure Policy adds jsonschema + dashmap; test it compiles
+          # and runs on top of full-opa.
+          - name: azure-policy
+            features: std,arc,full-opa,azure_policy
+
+          # Azure RBAC adds regex + time + net on top of full-opa.
+          - name: azure-rbac
+            features: std,arc,full-opa,azure-rbac
+
+          # no_std with the OPA-compatible feature set: exercises the
+          # spin_no_std codepath and absence of std-only dependencies.
+          - name: no_std
+            features: arc,opa-no-std
+
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - name: Setup Rust toolchain
+      uses: ./.github/actions/toolchains/rust
+    - name: Cache cargo
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      with:
+        shared-key: ${{ runner.os }}-regorus-features
+    - name: Fetch dependencies
+      run: cargo fetch --locked
+    - name: Build
+      run: cargo build --no-default-features --features "${{ matrix.features }}" --frozen
+    - name: Test
+      run: cargo test --no-default-features --features "${{ matrix.features }}" --frozen
diff --git a/.github/workflows/miri.yml b/.github/workflows/miri.yml
index 3c81fd13..58435dd4 100644
--- a/.github/workflows/miri.yml
+++ b/.github/workflows/miri.yml
@@ -14,7 +14,7 @@ jobs:
       MIRIFLAGS: "-Zmiri-disable-isolation"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - uses: ./.github/actions/toolchains/rust
         with:
           toolchain: nightly
diff --git a/.github/workflows/pr-extensions.yml b/.github/workflows/pr-extensions.yml
index b4caed2b..8d219155 100644
--- a/.github/workflows/pr-extensions.yml
+++ b/.github/workflows/pr-extensions.yml
@@ -24,7 +24,7 @@ jobs:
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo
-      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
         shared-key: ${{ runner.os }}-regorus
     - name: Fetch dependencies
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 63574ae9..068abce6 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -24,7 +24,7 @@ jobs:
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo
-      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
         shared-key: ${{ runner.os }}-regorus
     - name: Fetch dependencies
diff --git a/.github/workflows/publish-java.yml b/.github/workflows/publish-java.yml
index b7c244ed..63d11eb4 100644
--- a/.github/workflows/publish-java.yml
+++ b/.github/workflows/publish-java.yml
@@ -56,7 +56,7 @@ jobs:
       - run: cargo ${{ matrix.build_cmd || 'build' }} --release --frozen --target ${{ matrix.target }}${{ matrix.glibc && format('.{0}', matrix.glibc) || '' }} --manifest-path ./bindings/java/Cargo.toml
       - run: mkdir -p native/${{ matrix.target }}
       - run: mv target/${{ matrix.target }}/release/*.${{ matrix.extension }} ./native/${{ matrix.target }}/
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: native-libraries-${{ matrix.target }}
           path: native/
@@ -76,14 +76,14 @@ jobs:
           server-id: ossrh
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: native-libraries-*
           merge-multiple: true
           path: ./bindings/java/native/
       - run: mvn package
         working-directory: ./bindings/java
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: built-jars
           path: ./bindings/java/target/regorus-java-*.jar
diff --git a/.github/workflows/publish-python.yml b/.github/workflows/publish-python.yml
index c801471b..e42bfbcf 100644
--- a/.github/workflows/publish-python.yml
+++ b/.github/workflows/publish-python.yml
@@ -34,14 +34,14 @@ jobs:
         working-directory: bindings/python
 
       - name: Build wheels
-        uses: PyO3/maturin-action@b1bd829e37fef14c63f19162034228a2f3dc1021 # v1.43.0
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.43.0
         with:
           target: ${{ matrix.target }}
           args: --release --out dist --manifest-path bindings/python/Cargo.toml --offline --strip
           sccache: 'true'
           manylinux: auto
       - name: Upload wheels
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: wheels-linux-${{ matrix.target }}
           path: dist
@@ -67,13 +67,13 @@ jobs:
         working-directory: bindings/python
 
       - name: Build wheels
-        uses: PyO3/maturin-action@b1bd829e37fef14c63f19162034228a2f3dc1021 # v1.43.0
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.43.0
         with:
           target: ${{ matrix.target }}
           args: --release --out dist --manifest-path bindings/python/Cargo.toml --frozen --strip
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: wheels-windows-${{ matrix.target }}
           path: dist
@@ -98,13 +98,13 @@ jobs:
         working-directory: bindings/python
 
       - name: Build wheels
-        uses: PyO3/maturin-action@b1bd829e37fef14c63f19162034228a2f3dc1021 # v1.43.0
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.43.0
         with:
           target: ${{ matrix.target }}
           args: --release --out dist --manifest-path bindings/python/Cargo.toml --offline --strip
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: wheels-macos-${{ matrix.host.target }}
           path: dist
@@ -116,13 +116,13 @@ jobs:
     # if: "startsWith(github.ref, 'refs/tags/')"
     needs: [linux, windows, macos]
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: wheels-*
           merge-multiple: true
           path: wheels
       - name: Publish to PyPI
-        uses: PyO3/maturin-action@b1bd829e37fef14c63f19162034228a2f3dc1021 # v1.43.0
+        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.43.0
         env:
           MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
         with:
diff --git a/.github/workflows/publish-wasm.yml b/.github/workflows/publish-wasm.yml
index 24438a8d..9a7b6cb4 100644
--- a/.github/workflows/publish-wasm.yml
+++ b/.github/workflows/publish-wasm.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           fetch-depth: 0
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 4b97b244..4e7a8b9c 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Install Rust toolchain
         uses: ./.github/actions/toolchains/rust
       - name: Run release-plz
-        uses: MarcoIeni/release-plz-action@f708778669256143d984cce4b23592637532e040 # v0.5.127
+        uses: MarcoIeni/release-plz-action@1528104d2ca23787631a1c1f022abb64b34c1e11 # v0.5.128
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml
index 1b9ce46a..f4560bd3 100644
--- a/.github/workflows/rust-clippy.yml
+++ b/.github/workflows/rust-clippy.yml
@@ -37,7 +37,7 @@ jobs:
       - name: Setup Rust toolchain
         uses: ./.github/actions/toolchains/rust
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
 
@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload analysis results to GitHub
         if: ${{ hashFiles('rust-clippy-results.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.11
+        uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v3.29.11
         with:
           sarif_file: rust-clippy-results.sarif
           wait-for-processing: true
diff --git a/.github/workflows/test-c-cpp.yml b/.github/workflows/test-c-cpp.yml
index 50227db4..da966e95 100644
--- a/.github/workflows/test-c-cpp.yml
+++ b/.github/workflows/test-c-cpp.yml
@@ -22,7 +22,7 @@ jobs:
 
       - uses: ./.github/actions/toolchains/rust
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
diff --git a/.github/workflows/test-csharp.yml b/.github/workflows/test-csharp.yml
index 20ad0c77..a52db593 100644
--- a/.github/workflows/test-csharp.yml
+++ b/.github/workflows/test-csharp.yml
@@ -46,7 +46,7 @@ jobs:
         with:
           targets: ${{ matrix.runtime.target }}
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
@@ -59,7 +59,7 @@ jobs:
         run: cargo xtask build-ffi --release --target ${{ matrix.runtime.target }}
         
       - name: Upload regorus ffi shared library
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: regorus-ffi-artifacts-${{ matrix.runtime.target }}
           # Note: The full path of each artifact relative to . is preserved.
@@ -77,14 +77,14 @@ jobs:
         with:
           fetch-depth: 0  
       - uses: ./.github/actions/toolchains/rust
-      - uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           global-json-file: ./bindings/csharp/global.json
 
       - run: echo '${{ steps.stepid.outputs.dotnet-version }}'
 
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
 
@@ -92,7 +92,7 @@ jobs:
         run: cargo fetch --locked
 
       - name: Download regorus ffi shared libraries
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: regorus-ffi-artifacts-*
           merge-multiple: true
@@ -105,7 +105,7 @@ jobs:
         run: cargo xtask build-csharp --release --clean --artifacts-dir ./bindings/csharp/Regorus/tmp/bindings/ffi/target --enforce-artifacts --repository-commit ${{ github.sha }} --include-symbols
 
       - name: Upload Regorus nuget
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: regorus-nuget
           path: |
@@ -137,14 +137,14 @@ jobs:
 
       - uses: ./.github/actions/toolchains/rust
 
-      - uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           global-json-file: ./bindings/csharp/global.json
 
       - run: echo '${{ steps.stepid.outputs.dotnet-version }}'
 
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
 
@@ -152,7 +152,7 @@ jobs:
         run: cargo fetch --locked
 
       - name: Download regorus nuget
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: regorus-nuget
           path: ./bindings/csharp/Regorus/bin/Release
diff --git a/.github/workflows/test-ffi.yml b/.github/workflows/test-ffi.yml
index cc6b63d0..780e85a2 100644
--- a/.github/workflows/test-ffi.yml
+++ b/.github/workflows/test-ffi.yml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
diff --git a/.github/workflows/test-go.yml b/.github/workflows/test-go.yml
index 80eb4843..836386d4 100644
--- a/.github/workflows/test-go.yml
+++ b/.github/workflows/test-go.yml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
@@ -30,7 +30,7 @@ jobs:
       - name: Fetch FFI crate dependencies
         run: cargo fetch --locked --manifest-path bindings/ffi/Cargo.toml
 
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           architecture: x64
 
diff --git a/.github/workflows/test-java.yml b/.github/workflows/test-java.yml
index 053dc36c..1b3f946e 100644
--- a/.github/workflows/test-java.yml
+++ b/.github/workflows/test-java.yml
@@ -26,7 +26,7 @@ jobs:
           distribution: "corretto"
       - uses: ./.github/actions/toolchains/rust
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
diff --git a/.github/workflows/test-musl.yml b/.github/workflows/test-musl.yml
index eea7527e..2774fe00 100644
--- a/.github/workflows/test-musl.yml
+++ b/.github/workflows/test-musl.yml
@@ -25,7 +25,7 @@ jobs:
       with:
         targets: x86_64-unknown-linux-musl
     - name: Cache cargo
-      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
         shared-key: ${{ runner.os }}-regorus
     - name: Fetch dependencies
diff --git a/.github/workflows/test-no-std.yml b/.github/workflows/test-no-std.yml
index 9773c26c..ed3b9bf9 100644
--- a/.github/workflows/test-no-std.yml
+++ b/.github/workflows/test-no-std.yml
@@ -25,7 +25,7 @@ jobs:
       with:
         targets: thumbv7m-none-eabi
     - name: Cache cargo
-      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
         shared-key: ${{ runner.os }}-regorus
     - name: Fetch dependencies
diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml
index 10601bdd..1f01a4e0 100644
--- a/.github/workflows/test-python.yml
+++ b/.github/workflows/test-python.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           targets: ${{ matrix.host.target }}
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
@@ -51,7 +51,7 @@ jobs:
         run: cargo xtask build-python --release --target ${{ matrix.host.target }} --target-dir bindings/python/dist --frozen
 
       - name: Upload wheel artefacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: regorus-wheel-${{ matrix.host.name }}
           path: bindings/python/dist/regorus-*.whl
@@ -70,7 +70,7 @@ jobs:
           fetch-depth: 0
       - uses: ./.github/actions/toolchains/rust
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
diff --git a/.github/workflows/test-ruby.yml b/.github/workflows/test-ruby.yml
index b50336b1..e6e08783 100644
--- a/.github/workflows/test-ruby.yml
+++ b/.github/workflows/test-ruby.yml
@@ -30,7 +30,7 @@ jobs:
           working-directory: "bindings/ruby"
 
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
 
diff --git a/.github/workflows/test-wasm.yml b/.github/workflows/test-wasm.yml
index 2c23325e..cf20cb59 100644
--- a/.github/workflows/test-wasm.yml
+++ b/.github/workflows/test-wasm.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Rust toolchain
         uses: ./.github/actions/toolchains/rust
       - name: Cache cargo
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ${{ runner.os }}-regorus
       - name: Fetch dependencies
@@ -33,7 +33,7 @@ jobs:
         run: cargo fetch --locked --manifest-path bindings/wasm/Cargo.toml
 
       - name: Setup Node
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
 
diff --git a/.github/workflows/tests-debug.yml b/.github/workflows/tests-debug.yml
index ed6abe1a..75b64310 100644
--- a/.github/workflows/tests-debug.yml
+++ b/.github/workflows/tests-debug.yml
@@ -24,7 +24,7 @@ jobs:
     - name: Setup Rust toolchain
       uses: ./.github/actions/toolchains/rust
     - name: Cache cargo
-      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
         shared-key: ${{ runner.os }}-regorus
     - name: Fetch dependencies
diff --git a/Cargo.toml b/Cargo.toml
index 2dbe5d3c..a75c9479 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -43,7 +43,7 @@ cache = ["dep:lru"]
 rvm = ["dep:postcard", "dep:indexmap"]
 semver = ["dep:semver"]
 allocator-memory-limits = ["std", "mimalloc", "mimalloc/allocator-memory-limits"]
-std = ["rand/std", "rand/std_rng", "serde_json/std", "msvc_spectre_libs", "dep:parking_lot" ]
+std = ["rand/std", "rand/std_rng", "serde_json/std", "indexmap?/std", "msvc_spectre_libs", "dep:parking_lot" ]
 time = ["dep:chrono", "dep:chrono-tz"]
 uuid = ["dep:uuid"]
 urlquery = ["dep:url"]
@@ -57,8 +57,6 @@ full-opa = [
     "hex",
     "http",
     "jsonschema",
-    "allocator-memory-limits",
-    "mimalloc",
     "net",
     "opa-runtime",
     "regex",
diff --git a/benches/rvm_benchmark.rs b/benches/rvm_benchmark.rs
index 2604be06..ce5092bf 100644
--- a/benches/rvm_benchmark.rs
+++ b/benches/rvm_benchmark.rs
@@ -57,6 +57,7 @@ use regorus::{Engine, Rc, Value};
 // hot path (memory_check, execution_timer_tick, instruction-limit compare).
 // ---------------------------------------------------------------------------
 
+#[cfg(feature = "allocator-memory-limits")]
 const MEMORY_LIMIT_BYTES: u64 = 256 * 1024 * 1024;
 const TIME_LIMIT: Duration = Duration::from_secs(30);
 const TIMER_CHECK_INTERVAL: NonZeroU32 = NonZeroU32::new(16).unwrap();
@@ -360,6 +361,7 @@ fn compile_all_programs() -> Vec<BenchmarkProgram> {
 /// Apply or remove production-style limits based on a boolean flag.
 fn configure_limits(vm: &mut RegoVM, limits: bool) {
     if limits {
+        #[cfg(feature = "allocator-memory-limits")]
         regorus::set_global_memory_limit(Some(MEMORY_LIMIT_BYTES));
         vm.set_execution_timer_config(Some(ExecutionTimerConfig {
             limit: TIME_LIMIT,
@@ -367,6 +369,7 @@ fn configure_limits(vm: &mut RegoVM, limits: bool) {
         }));
         vm.set_max_instructions(INSTRUCTION_LIMIT);
     } else {
+        #[cfg(feature = "allocator-memory-limits")]
         regorus::set_global_memory_limit(None);
         vm.set_execution_timer_config(None);
         vm.set_max_instructions(usize::MAX);
diff --git a/bindings/java/Cargo.toml b/bindings/java/Cargo.toml
index 07104487..a32284b8 100644
--- a/bindings/java/Cargo.toml
+++ b/bindings/java/Cargo.toml
@@ -14,7 +14,7 @@ keywords = ["interpreter", "opa", "policy-as-code", "rego"]
 crate-type = ["cdylib"]
 
 [features]
-default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa"]
+default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa", "regorus/allocator-memory-limits"]
 coverage = ["regorus/coverage"]
 ast = ["regorus/ast"]
 cache = ["regorus/cache"]
diff --git a/bindings/python/Cargo.toml b/bindings/python/Cargo.toml
index 87f2c944..f265c66b 100644
--- a/bindings/python/Cargo.toml
+++ b/bindings/python/Cargo.toml
@@ -15,7 +15,7 @@ keywords = ["interpreter", "opa", "policy-as-code", "rego"]
 crate-type = ["cdylib"]
 
 [features]
-default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa"]
+default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa", "regorus/allocator-memory-limits"]
 ast = ["regorus/ast"]
 cache = ["regorus/cache"]
 coverage = ["regorus/coverage"]
diff --git a/bindings/ruby/ext/regorusrb/Cargo.toml b/bindings/ruby/ext/regorusrb/Cargo.toml
index b2f18518..db89b357 100644
--- a/bindings/ruby/ext/regorusrb/Cargo.toml
+++ b/bindings/ruby/ext/regorusrb/Cargo.toml
@@ -11,7 +11,7 @@ crate-type = ["cdylib"]
 path = "src/lib.rs"
 
 [features]
-default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa"]
+default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa", "regorus/allocator-memory-limits"]
 ast = ["regorus/ast"]
 cache = ["regorus/cache"]
 coverage = ["regorus/coverage"]
diff --git a/xtask/src/tasks/ci/mod.rs b/xtask/src/tasks/ci/mod.rs
index 7250a0db..78349097 100644
--- a/xtask/src/tasks/ci/mod.rs
+++ b/xtask/src/tasks/ci/mod.rs
@@ -242,6 +242,10 @@ fn run_ci_suite(config: CiSuiteConfig) -> Result<()> {
         )?;
     }
 
+    // Verify that important feature subsets compile correctly.
+    // These catch issues like #595 where non-default combinations fail.
+    check_feature_combinations(&workspace, config.release, config.frozen)?;
+
     Ok(())
 }
 
@@ -364,3 +368,48 @@ fn base_cargo_args(
     }
     args
 }
+
+/// Verify that various feature subsets compile.
+///
+/// Library consumers may pick non-default feature combinations.  Running
+/// `cargo check` for each combination is fast and catches regressions like
+/// issue #595 (indexmap/std not propagated) early.
+///
+/// The weekly `feature-matrix.yml` workflow runs a superset of these with
+/// full `cargo test`; these PR checks are intentionally `cargo check` only
+/// to keep CI fast.
+fn check_feature_combinations(workspace: &Path, release: bool, frozen: bool) -> Result<()> {
+    let combos: &[&str] = &[
+        // Issue #595: library consumer with std + arc + rvm but no full-opa.
+        // Validates indexmap/std propagation via the weak-dep syntax.
+        "std,arc,rvm",
+        // full-opa without mimalloc: the new default after removing the
+        // vendored allocator from full-opa. All builtins, no allocator.
+        "std,arc,full-opa",
+        // Binding-style: full-opa plus the explicit allocator opt-in.
+        // Mirrors how ffi/java/python/ruby crates are configured.
+        "std,arc,full-opa,allocator-memory-limits",
+        // no_std codepath: exercises spin_no_std + absence of std deps.
+        "arc,opa-no-std",
+        // Cherry-picked builtins: popular features without full-opa to
+        // ensure individual feature gates compose correctly.
+        "std,arc,rvm,coverage,cache,regex,time",
+    ];
+
+    for features in combos {
+        let label = format!(
+            "cargo check --no-default-features --features {} (ci)",
+            features
+        );
+        run_ci_cargo_step(
+            workspace,
+            "check",
+            release,
+            frozen,
+            Some(features),
+            &["--no-default-features"],
+            &label,
+        )?;
+    }
+    Ok(())
+}