diff --git a/.cargo/config.toml b/.cargo/config.toml
index e6e617d..d8d2edf 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -11,3 +11,9 @@ min-publish-age = true
 
 [registry]
 global-min-publish-age = "14 days"
+
+# Reject too-new versions even when a user-level cargo config sets "allow".
+# The CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE environment variable still
+# overrides this for one-off updates.
+[resolver]
+incompatible-publish-age = "deny"