diff --git a/.rector.php b/.rector.php
index 7a865f6..81dcad1 100644
--- a/.rector.php
+++ b/.rector.php
@@ -27,11 +27,31 @@
         glob(__DIR__ . '/*.php') ?: [],
     )))
     // No argument: Rector reads the target PHP version from composer.json
-    // (require.php's floor, else config.platform.php), kept at 8.3 by the sync.
+    // (require.php's floor, else config.platform.php), which the sync keeps in
+    // step with maho.
     ->withPhpSets()
+    // The sets above are taken wholesale, unlike maho's own config, which pins
+    // them to an old target and hand-picks the newer rules by name. These three
+    // are what that policy guards against, and they are wrong for a published
+    // package:
+    //
+    //  - AddTypeToConst emits `const string FOO`. That is new syntax, not a
+    //    rewrite, so a repo that declares no require.php floor (such as
+    //    maho-composer-plugin) would ship code its own metadata never promised.
+    //    A composer plugin also runs on the user's PHP, not on the platform the
+    //    project resolved against.
+    //  - ReadOnlyClass / ReadOnlyProperty change the contract, not the code: a
+    //    readonly class cannot be extended by a normal child, and a readonly
+    //    property cannot be written from one. Maho modules exist to be extended.
+    //
+    // Everything else in the sets is a safe rewrite, so keep the derivation.
+    ->withSkip([
+        Rector\Php81\Rector\Property\ReadOnlyPropertyRector::class,
+        Rector\Php82\Rector\Class_\ReadOnlyClassRector::class,
+        Rector\Php83\Rector\ClassConst\AddTypeToConstRector::class,
+    ])
     ->withRules([
         CodeQuality\BooleanNot\ReplaceMultipleBooleanNotRector::class,
-        CodeQuality\Foreach_\UnusedForeachValueToArrayKeysRector::class,
         CodeQuality\FuncCall\ChangeArrayPushToArrayAssignRector::class,
         CodeQuality\FuncCall\CompactToVariablesRector::class,
         CodeQuality\Identical\SimplifyArraySearchRector::class,