diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 9be19c4..f67cedd 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -37,10 +37,11 @@ jobs:
           node-version: 22
           cache: 'yarn'
 
-      - name: Install
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy, rustfmt
+      # Reads rust-toolchain.toml (version and components), the same pin the
+      # nix dev shell builds from — a floating stable here once linted code
+      # the dev shell's clippy had never seen.
+      - name: Install Rust from rust-toolchain.toml
+        run: rustup toolchain install
 
       - name: Install dependencies
         run: yarn install
@@ -187,6 +188,7 @@ jobs:
           docker run --rm \
             --user 0:0 \
             -e RUST_VERSION=${{ env.RUST_VERSION }} \
+            -e RUSTUP_TOOLCHAIN=${{ env.RUST_VERSION }} \
             -v /tmp/build.sh:/tmp/build.sh \
             -v ${{ github.workspace }}/.cargo-cache/git/db:/usr/local/cargo/git/db \
             -v ${{ github.workspace }}/.cargo/registry/cache:/usr/local/cargo/registry/cache \
@@ -195,10 +197,15 @@ jobs:
             -w /build \
             ${{ matrix.settings.docker }} \
             sh /tmp/build.sh
+      # RUSTUP_TOOLCHAIN outranks rust-toolchain.toml's directory override,
+      # which would otherwise hijack these release builds onto the lint
+      # toolchain (whose cross-targets are not installed).
       - name: Build
         run: ${{ matrix.settings.build }}
         if: ${{ !matrix.settings.docker }}
         shell: bash
+        env:
+          RUSTUP_TOOLCHAIN: ${{ env.RUST_VERSION }}
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
diff --git a/flake.lock b/flake.lock
index 8c20521..b9d9772 100644
--- a/flake.lock
+++ b/flake.lock
@@ -23,11 +23,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1779790483,
-        "narHash": "sha256-2wCMtmVmkCcyHaH6hkrbx7XdUgLYP5E1wl/jc1YxxTY=",
+        "lastModified": 1785314864,
+        "narHash": "sha256-imz9J5iMNersDeQ1ymenFg35N6C2R3MCaGg2i0XCIrE=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "6012e5463531342033571efe294ec880bf13dd95",
+        "rev": "594418b2c9ea0731bee6988236ef5bfd97e81dca",
         "type": "github"
       },
       "original": {
@@ -81,11 +81,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1779742949,
-        "narHash": "sha256-Dk0hnFTXbmNmigsJyQkCz2NEEgtpe+MN500dPnki9Ic=",
+        "lastModified": 1785261141,
+        "narHash": "sha256-sA+DHPejWD68mLA7gtTiHGd5T41F6W+NKf0g+ibFCW4=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "462d95ca60fa7360b44258be94105bc20e203684",
+        "rev": "bec66814323579659ffd77c909b3d963af118ece",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index af0fed2..6070a90 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,19 +28,14 @@
 
         fenixPkgs = fenix.packages.${localSystem};
 
-        # Crane needs cargo >= 1.91 (`cargo package --exclude-lockfile`).
-        # Cargo.toml's `rust-version = "1.85"` remains the MSRV for downstream
-        # consumers; this toolchain is only for the dev shell and CI checks.
-        rustToolchain = fenixPkgs.combine [
-          (fenixPkgs.stable.withComponents [
-            "cargo"
-            "clippy"
-            "rust-src"
-            "rustc"
-            "rustfmt"
-          ])
-          fenixPkgs.stable.rust-analyzer
-        ];
+        # Pinned by rust-toolchain.toml so the dev shell runs the exact
+        # toolchain CI lints with; see the comment there. The sha256 pins the
+        # channel's component set and must be bumped together with the
+        # channel (build once with lib.fakeSha256 to learn the new one).
+        rustToolchain = fenixPkgs.fromToolchainFile {
+          file = ./rust-toolchain.toml;
+          sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
+        };
 
         craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
         src = craneLib.cleanCargoSource ./.;
@@ -73,6 +68,12 @@
         devShells.default = pkgs.mkShell {
           name = "lightning-js-dev";
 
+          # Nix's fortify hardening breaks tikv-jemalloc-sys debug builds: the
+          # wrapper injects _FORTIFY_SOURCE, cargo passes -O0, glibc emits a
+          # #warning, and jemalloc's -Werror configure probes all fail
+          # ("cannot determine return type of strerror_r").
+          hardeningDisable = [ "fortify" ];
+
           packages = with pkgs; [
             nodejs_22
             yarn
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..903eaf9
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,11 @@
+# Single source of truth for the dev-shell and CI-check toolchain: the flake
+# reads this via fenix fromToolchainFile and rustup reads it natively in CI,
+# so the two cannot drift (a floating CI "stable" once linted code the dev
+# shell's clippy had never seen). Cargo.toml's `rust-version = "1.85"` stays
+# the MSRV for downstream consumers. The napi release builds pin their own
+# RUST_VERSION in CI.yml and set RUSTUP_TOOLCHAIN, which outranks this file's
+# directory override; without that they would silently build under this
+# toolchain with no cross-targets installed.
+[toolchain]
+channel = "1.97.0"
+components = ["clippy", "rustfmt", "rust-src", "rust-analyzer"]