diff --git a/lib/devbase/cli.py b/lib/devbase/cli.py
index 1e20f38..e2fd4be 100644
--- a/lib/devbase/cli.py
+++ b/lib/devbase/cli.py
@@ -179,7 +179,7 @@ def _add_env_parser(subparsers):
                             metavar='FILE', dest='identities',
                             help=("age / OpenSSH private key file (repeatable). "
                                   "Default: ~/.ssh/id_ed25519, then ~/.ssh/id_rsa "
-                                  "(all existing ones)"))
+                                  "(first existing one)"))
     env_import.add_argument('--passphrase-env', metavar='VAR', default=None,
                             help='Read passphrase from environment variable VAR')
     env_import.add_argument('--passphrase-stdin', action='store_true',
diff --git a/lib/devbase/env/bundle.py b/lib/devbase/env/bundle.py
index 33fdd4b..e957096 100644
--- a/lib/devbase/env/bundle.py
+++ b/lib/devbase/env/bundle.py
@@ -164,10 +164,10 @@ def _validate_manifest(manifest: Dict, members: Dict[str, bytes]) -> None:
     version = manifest.get('version')
     if not isinstance(version, int):
         raise BundleError("manifest.version が不正です")
-    if version != SUPPORTED_MANIFEST_VERSION:
+    if version > SUPPORTED_MANIFEST_VERSION:
         raise BundleError(
             f"manifest.version={version} はこの devbase ではサポートされていません "
-            f"(対応={SUPPORTED_MANIFEST_VERSION})。devbase 本体を更新してください"
+            f"(対応最大={SUPPORTED_MANIFEST_VERSION})。devbase 本体を更新してください"
         )
 
     files = manifest.get('files') or []
diff --git a/lib/devbase/env/io_import.py b/lib/devbase/env/io_import.py
index 616b9b7..6107e1f 100644
--- a/lib/devbase/env/io_import.py
+++ b/lib/devbase/env/io_import.py
@@ -85,10 +85,6 @@ def _validate_options(opts: ImportOptions) -> None:
         )
     if opts.passphrase_env and opts.passphrase_stdin:
         raise ImportError("--passphrase-env と --passphrase-stdin は併用できません")
-    if opts.identities and (opts.passphrase_env or opts.passphrase_stdin):
-        raise ImportError(
-            "--identity と --passphrase-env/--passphrase-stdin は併用できません"
-        )
 
 
 def _decrypt_if_needed(blob: bytes, opts: ImportOptions) -> bytes:
diff --git a/tests/cli/test_env_import.py b/tests/cli/test_env_import.py
index 5926a58..edbd98d 100644
--- a/tests/cli/test_env_import.py
+++ b/tests/cli/test_env_import.py
@@ -206,18 +206,6 @@ def test_import_rejects_both_passphrase_env_and_stdin(dest_root):
             source='/dev/null', passphrase_env='X', passphrase_stdin=True))
 
 
-def test_import_rejects_identity_with_passphrase(dest_root):
-    """--identity と --passphrase-env/--passphrase-stdin の同時指定は拒否される"""
-    with pytest.raises(ImportBundleError, match="--identity と --passphrase"):
-        import_bundle(dest_root, ImportOptions(
-            source='/dev/null', identities=['/tmp/fake.key'],
-            passphrase_env='X'))
-    with pytest.raises(ImportBundleError, match="--identity と --passphrase"):
-        import_bundle(dest_root, ImportOptions(
-            source='/tmp/dummy', identities=['/tmp/fake.key'],
-            passphrase_stdin=True))
-
-
 def test_read_passphrase_uses_getpass_on_tty(monkeypatch):
     """tty 入力時は getpass.getpass を使い stdin.readline は呼ばない (エコー抑止)"""
     fake_stdin = io.StringIO("should-not-be-read\n")
diff --git a/tests/env/test_bundle.py b/tests/env/test_bundle.py
index d70bf2c..5e44663 100644
--- a/tests/env/test_bundle.py
+++ b/tests/env/test_bundle.py
@@ -49,12 +49,7 @@ def test_unpack_rejects_corrupted_sha256():
         bundle.unpack(out.getvalue())
 
 
-@pytest.mark.parametrize("bad_version", [
-    bundle.SUPPORTED_MANIFEST_VERSION + 1,
-    0,
-    -1,
-])
-def test_unpack_rejects_unknown_version(bad_version):
+def test_unpack_rejects_unknown_version():
     entries = [_entry("env/global.env", b"FOO=bar\n")]
     blob = bundle.pack(entries)
 
@@ -67,7 +62,7 @@ def test_unpack_rejects_unknown_version(bad_version):
             data = tin.extractfile(info).read()
             if info.name == bundle.MANIFEST_NAME:
                 m = yaml.safe_load(data)
-                m["version"] = bad_version
+                m["version"] = bundle.SUPPORTED_MANIFEST_VERSION + 1
                 data = yaml.safe_dump(m).encode("utf-8")
                 info.size = len(data)
             tout.addfile(info, io.BytesIO(data))