diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d26c85804..216cfa0f4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,3 +7,10 @@ updates:
     time: "10:00"
     timezone: America/Los_Angeles
   open-pull-requests-limit: 10
+- package-ecosystem: rust-toolchain
+  directory: "/"
+  schedule:
+    interval: daily
+    time: "10:00"
+    timezone: America/Los_Angeles
+  open-pull-requests-limit: 10
diff --git a/.github/workflows/build_linux.yml b/.github/workflows/build_linux.yml
index 01d481324..b81978bea 100644
--- a/.github/workflows/build_linux.yml
+++ b/.github/workflows/build_linux.yml
@@ -154,10 +154,7 @@ jobs:
             src/rust/target
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-
-      - uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
+      - uses: dtolnay/rust-toolchain@stable
       - name: build
         run: cargo build 
         working-directory: ./src/rust
diff --git a/.github/workflows/build_mac.yml b/.github/workflows/build_mac.yml
index 77f296cda..3c2d08983 100644
--- a/.github/workflows/build_mac.yml
+++ b/.github/workflows/build_mac.yml
@@ -203,10 +203,7 @@ jobs:
             src/rust/target
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-
-      - uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
+      - uses: dtolnay/rust-toolchain@stable
       - name: build
         run: cargo build
         working-directory: ./src/rust
\ No newline at end of file
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 9257ae05c..17b6d8678 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -3,6 +3,7 @@ on:
   push:
     paths:
     - '.github/workflows/format.yml'
+    - 'rust-toolchain.toml'
     - 'src/**.c'
     - 'src/**.h'
     - 'src/rust/**'
@@ -12,6 +13,7 @@ on:
     types: [opened, synchronize, reopened]
     paths:
     - '.github/workflows/format.yml'
+    - 'rust-toolchain.toml'
     - 'src/**.c'
     - 'src/**.h'
     - 'src/rust/**'
@@ -43,11 +45,7 @@ jobs:
             ${{ matrix.workdir }}/target
           key: ${{ runner.os }}-cargo-${{ hashFiles('${{ matrix.workdir }}/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-
-      - uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-          components: rustfmt, clippy
+      - uses: dtolnay/rust-toolchain@stable
       - name: dependencies
         run: sudo apt update && sudo apt install libtesseract-dev  libavformat-dev libavdevice-dev libswscale-dev yasm
       - name: rustfmt
diff --git a/.github/workflows/test_rust.yml b/.github/workflows/test_rust.yml
index a032f1e62..511ec3794 100644
--- a/.github/workflows/test_rust.yml
+++ b/.github/workflows/test_rust.yml
@@ -3,6 +3,7 @@ on:
   push:
     paths:
       - ".github/workflows/test.yml"
+      - "rust-toolchain.toml"
       - "src/rust/**"
     tags-ignore:
       - "*.*"
@@ -10,6 +11,7 @@ on:
     types: [opened, synchronize, reopened]
     paths:
       - ".github/workflows/test.yml"
+      - "rust-toolchain.toml"
       - "src/rust/**"
 jobs:
   test_rust:
@@ -29,10 +31,7 @@ jobs:
             src/rust/lib_ccxr/target
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-
-      - uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
+      - uses: dtolnay/rust-toolchain@stable
       - name: Test main module
         run: cargo test
         working-directory: ./src/rust
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 000000000..8d3abc0ab
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,10 @@
+# Pinned so that a new stable rustc cannot introduce clippy lints that fail
+# PRs which did not touch the offending code. Bumping this is a deliberate
+# change; Dependabot opens a PR when a new release is available, and any new
+# lints get fixed there, once, instead of in every open PR.
+[toolchain]
+channel = "1.98.1"
+components = ["rustfmt", "clippy"]
+# The MSVC builds cross-compile with `cargo build --target` (windows/rust.bat),
+# so the target std must exist for the pinned toolchain.
+targets = ["x86_64-pc-windows-msvc", "i686-pc-windows-msvc"]