diff --git a/pyproject.toml b/pyproject.toml
index 5f1bcc75f511..d023c52ad13a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,7 @@ requires = [
     "cffi>=1.12; platform_python_implementation != 'PyPy'",
     # Needed because cffi imports distutils, and in Python 3.12, distutils has
     # been removed from the stdlib, but installing setuptools puts it back.
-    "setuptools",
+    "setuptools!=74.0.0,!=74.1.0",
 ]
 build-backend = "maturin"
 
diff --git a/src/rust/cryptography-x509-verification/src/types.rs b/src/rust/cryptography-x509-verification/src/types.rs
index dfb05b9b52f2..0cd84489e089 100644
--- a/src/rust/cryptography-x509-verification/src/types.rs
+++ b/src/rust/cryptography-x509-verification/src/types.rs
@@ -10,6 +10,8 @@ use asn1::IA5String;
 // RFC 2822 3.2.4
 static ATEXT_CHARS: &str = "!#$%&'*+-/=?^_`{|}~";
 
+/// Represents a DNS name can be used in X.509 name matching.
+///
 /// A `DNSName` is an `asn1::IA5String` with additional invariant preservations
 /// per [RFC 5280 4.2.1.6], which in turn uses the preferred name syntax defined
 /// in [RFC 1034 3.5] and amended in [RFC 1123 2.1].
@@ -100,6 +102,9 @@ impl PartialEq for DNSName<'_> {
     }
 }
 
+/// Represents either a DNS name or a DNS wildcard for use in X.509 name
+/// matching.
+///
 /// A `DNSPattern` represents a subset of the domain name wildcard matching
 /// behavior defined in [RFC 6125 6.4.3]. In particular, all DNS patterns
 /// must either be exact matches (post-normalization) *or* a single wildcard