diff --git a/external/keyring-manager b/external/keyring-manager
index c153eb30..b127b2d3 160000
--- a/external/keyring-manager
+++ b/external/keyring-manager
@@ -1 +1 @@
-Subproject commit c153eb3015d6d118e5d467865510d053ddd84533
+Subproject commit b127b2d3c653fea163a776dd58b3798f28aeeee3
diff --git a/veilid-core/src/network_manager/mod.rs b/veilid-core/src/network_manager/mod.rs
index cb3672ac..2ba43538 100644
--- a/veilid-core/src/network_manager/mod.rs
+++ b/veilid-core/src/network_manager/mod.rs
@@ -1346,19 +1346,19 @@ impl NetworkManager {
         let ts = get_timestamp();
         let ets = envelope.get_timestamp();
         if let Some(tsbehind) = tsbehind {
-            if tsbehind > 0 && (ts > ets && ts - ets > tsbehind) {
+            if tsbehind > 0 && (ts > ets && ts.saturating_sub(ets) > tsbehind) {
                 log_net!(debug
                     "envelope time was too far in the past: {}ms ",
-                    timestamp_to_secs(ts - ets) * 1000f64
+                    timestamp_to_secs(ts.saturating_sub(ets)) * 1000f64
                 );
                 return Ok(false);
             }
         }
         if let Some(tsahead) = tsahead {
-            if tsahead > 0 && (ts < ets && ets - ts > tsahead) {
+            if tsahead > 0 && (ts < ets && ets.saturating_sub(ts) > tsahead) {
                 log_net!(debug
                     "envelope time was too far in the future: {}ms",
-                    timestamp_to_secs(ets - ts) * 1000f64
+                    timestamp_to_secs(ets.saturating_sub(ts)) * 1000f64
                 );
                 return Ok(false);
             }
diff --git a/veilid-core/src/network_manager/tasks/rolling_transfers.rs b/veilid-core/src/network_manager/tasks/rolling_transfers.rs
index c3774b6a..0e924024 100644
--- a/veilid-core/src/network_manager/tasks/rolling_transfers.rs
+++ b/veilid-core/src/network_manager/tasks/rolling_transfers.rs
@@ -30,7 +30,7 @@ impl NetworkManager {
                 );
 
                 // While we're here, lets see if this address has timed out
-                if cur_ts - stats.last_seen_ts >= IPADDR_MAX_INACTIVE_DURATION_US {
+                if cur_ts.saturating_sub(stats.last_seen_ts) >= IPADDR_MAX_INACTIVE_DURATION_US {
                     // it's dead, put it in the dead list
                     dead_addrs.insert(*addr);
                 }
diff --git a/veilid-core/src/routing_table/bucket_entry.rs b/veilid-core/src/routing_table/bucket_entry.rs
index 51f79498..c64cb7ee 100644
--- a/veilid-core/src/routing_table/bucket_entry.rs
+++ b/veilid-core/src/routing_table/bucket_entry.rs
@@ -721,7 +721,7 @@ impl BucketEntryInner {
         self.transfer_stats_accounting.add_down(bytes);
         self.peer_stats.rpc_stats.messages_rcvd += 1;
         self.peer_stats.rpc_stats.questions_in_flight -= 1;
-        self.record_latency(recv_ts - send_ts);
+        self.record_latency(recv_ts.saturating_sub(send_ts));
         self.touch_last_seen(recv_ts);
         self.peer_stats.rpc_stats.recent_lost_answers = 0;
     }
diff --git a/veilid-core/src/routing_table/node_ref.rs b/veilid-core/src/routing_table/node_ref.rs
index edb501f0..8ae8929a 100644
--- a/veilid-core/src/routing_table/node_ref.rs
+++ b/veilid-core/src/routing_table/node_ref.rs
@@ -319,7 +319,7 @@ pub trait NodeRefBase: Sized {
         self.operate_mut(|rti, e| {
             rti.transfer_stats_accounting().add_down(bytes);
             rti.latency_stats_accounting()
-                .record_latency(recv_ts - send_ts);
+                .record_latency(recv_ts.saturating_sub(send_ts));
             e.answer_rcvd(send_ts, recv_ts, bytes);
         })
     }
diff --git a/veilid-core/src/routing_table/route_spec_store.rs b/veilid-core/src/routing_table/route_spec_store.rs
index 89e1d35a..4dea0c30 100644
--- a/veilid-core/src/routing_table/route_spec_store.rs
+++ b/veilid-core/src/routing_table/route_spec_store.rs
@@ -1597,7 +1597,7 @@ impl RouteSpecStore {
             .remote_private_route_cache
             .entry(pr_pubkey)
             .and_modify(|rpr| {
-                if cur_ts - rpr.last_touched_ts >= REMOTE_PRIVATE_ROUTE_CACHE_EXPIRY {
+                if cur_ts.saturating_sub(rpr.last_touched_ts) >= REMOTE_PRIVATE_ROUTE_CACHE_EXPIRY {
                     // Start fresh if this had expired
                     rpr.last_seen_our_node_info_ts = 0;
                     rpr.last_touched_ts = cur_ts;
@@ -1640,7 +1640,7 @@ impl RouteSpecStore {
         F: FnOnce(&mut RemotePrivateRouteInfo) -> R,
     {
         let rpr = inner.cache.remote_private_route_cache.get_mut(key)?;
-        if cur_ts - rpr.last_touched_ts < REMOTE_PRIVATE_ROUTE_CACHE_EXPIRY {
+        if cur_ts.saturating_sub(rpr.last_touched_ts) < REMOTE_PRIVATE_ROUTE_CACHE_EXPIRY {
             rpr.last_touched_ts = cur_ts;
             return Some(f(rpr));
         }
@@ -1662,7 +1662,7 @@ impl RouteSpecStore {
         match inner.cache.remote_private_route_cache.entry(*key) {
             hashlink::lru_cache::Entry::Occupied(mut o) => {
                 let rpr = o.get_mut();
-                if cur_ts - rpr.last_touched_ts < REMOTE_PRIVATE_ROUTE_CACHE_EXPIRY {
+                if cur_ts.saturating_sub(rpr.last_touched_ts) < REMOTE_PRIVATE_ROUTE_CACHE_EXPIRY {
                     return Some(f(rpr));
                 }
                 o.remove();
diff --git a/veilid-core/src/routing_table/stats_accounting.rs b/veilid-core/src/routing_table/stats_accounting.rs
index 7167636e..c02ab6ca 100644
--- a/veilid-core/src/routing_table/stats_accounting.rs
+++ b/veilid-core/src/routing_table/stats_accounting.rs
@@ -45,7 +45,7 @@ impl TransferStatsAccounting {
         cur_ts: u64,
         transfer_stats: &mut TransferStatsDownUp,
     ) {
-        let dur_ms = (cur_ts - last_ts) / 1000u64;
+        let dur_ms = cur_ts.saturating_sub(last_ts) / 1000u64;
         while self.rolling_transfers.len() >= ROLLING_TRANSFERS_SIZE {
             self.rolling_transfers.pop_front();
         }
diff --git a/veilid-core/src/rpc_processor/operation_waiter.rs b/veilid-core/src/rpc_processor/operation_waiter.rs
index 3bf14b94..3f56e339 100644
--- a/veilid-core/src/rpc_processor/operation_waiter.rs
+++ b/veilid-core/src/rpc_processor/operation_waiter.rs
@@ -130,7 +130,7 @@ where
                 //xxx: causes crash (Missing otel data span extensions)
                 // Span::current().follows_from(span_id);
 
-                (ret, end_ts - start_ts)
+                (ret, end_ts.saturating_sub(start_ts))
             }))
     }
 }