diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2afa5e2..40a1dd4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,16 @@ cut and that this clone does not carry.
 
 ## [Unreleased]
 
+## [0.0.86] - 2026-09-30
+
+The rendered workflows move `setup-rust-toolchain` from 1.17.0 to
+2.0.0 — the bump dependabot proposed on every tree, taken at the
+renderer so the trees stay generated rather than diverged. v2 sets the
+warnings-as-errors default through cargo's `build.warnings` config
+instead of `RUSTFLAGS`, which composes better with `.cargo/config.toml`,
+and adds a panic-location matcher. Product code, protocol, ownership,
+software pins and the kit are unchanged.
+
 ## [0.0.85] - 2026-09-30
 
 A third audit of the seven rendered trees against the shipped
diff --git a/Cargo.lock b/Cargo.lock
index 74641e9..bccc30a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -66,7 +66,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "harness-runtime"
-version = "0.0.85"
+version = "0.0.86"
 dependencies = [
  "provider-v3",
  "serde",
@@ -128,7 +128,7 @@ dependencies = [
 
 [[package]]
 name = "opencode-setup-system"
-version = "0.0.85"
+version = "0.0.86"
 dependencies = [
  "harness-runtime",
  "provider-v3",
@@ -147,7 +147,7 @@ dependencies = [
 
 [[package]]
 name = "provider-v3"
-version = "0.0.85"
+version = "0.0.86"
 dependencies = [
  "serde",
  "serde_json",
@@ -209,7 +209,7 @@ dependencies = [
 
 [[package]]
 name = "setup-core"
-version = "0.0.85"
+version = "0.0.86"
 dependencies = [
  "miniz_oxide",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index c867ed8..cde79bd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.0.85"
+version = "0.0.86"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
 # `setup-core::archive`); an inflate loop is not, because its bugs are
 # memory-safety bugs and it is not improved by being hand-written here.
 miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.85" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.85" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.85" }
+setup-core = { path = "crates/setup-core", version = "0.0.86" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.86" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.86" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
diff --git a/README.md b/README.md
index d5ff8ff..5d149b8 100644
--- a/README.md
+++ b/README.md
@@ -180,7 +180,7 @@ release is a convenience, not the authorised copy.
 
 ```bash
 docker run --rm -v "$HOME/.config:/config" \
-  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.85 \
+  ghcr.io/nddev-opennetwork/opencode-setup-system:0.0.86 \
   status --target /config/<dir> --json
 ```
 
diff --git a/install.ps1 b/install.ps1
index d616994..2c9cd85 100644
--- a/install.ps1
+++ b/install.ps1
@@ -7,7 +7,7 @@
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
 [CmdletBinding()]
 param(
-  [string]$Version = "0.0.85",
+  [string]$Version = "0.0.86",
   [string]$InstallDir = $(if ($env:OPENCODE_INSTALL_DIR) { $env:OPENCODE_INSTALL_DIR } else { "$env:LOCALAPPDATA\Programs\opencode-setup-system" })
 )
 $ErrorActionPreference = "Stop"
diff --git a/install.sh b/install.sh
index c35f057..a1c2668 100644
--- a/install.sh
+++ b/install.sh
@@ -14,7 +14,7 @@ set -eu
 
 REPO="NDDev-OpenNetwork/opencode-setup-system"
 BINARY="opencode-setup-system"
-VERSION="${1:-0.0.85}"
+VERSION="${1:-0.0.86}"
 PREFIX="${OPENCODE_INSTALL_DIR:-$HOME/.local/bin}"
 
 case "$(uname -s)" in