diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a8cc420f..a15882250 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -375,9 +375,24 @@ jobs:
           cache: npm
           cache-dependency-path: cli-connection-reader/package-lock.json
 
-      - uses: dtolnay/rust-toolchain@stable
+      # This job runs Cargo from the repository root, so it must read the pin
+      # explicitly instead of relying on the current directory.
+      - name: Read pinned toolchain
+        id: pin
+        shell: bash
+        run: |
+          channel=$(sed -n 's/^[[:space:]]*channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' cli/rust-toolchain.toml | head -1)
+          if [ -z "$channel" ]; then
+            echo "::error::could not read [toolchain] channel from cli/rust-toolchain.toml"
+            exit 1
+          fi
+          echo "Pinned toolchain: $channel"
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
+      - name: Install Rust ${{ steps.pin.outputs.channel }}
+        uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.88.0
+          toolchain: ${{ steps.pin.outputs.channel }}
 
       - name: Build source AWARE host
         run: cargo build --manifest-path cli/Cargo.toml --locked
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7238ac132..15c89d2a8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,8 +38,24 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      # Read the repository pin explicitly because this job builds Rust from
+      # more than one working directory.
+      - name: Read pinned toolchain
+        id: pin
+        shell: bash
+        run: |
+          channel=$(sed -n 's/^[[:space:]]*channel[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' cli/rust-toolchain.toml | head -1)
+          if [ -z "$channel" ]; then
+            echo "::error::could not read [toolchain] channel from cli/rust-toolchain.toml"
+            exit 1
+          fi
+          echo "Pinned toolchain: $channel"
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
+      - name: Install Rust ${{ steps.pin.outputs.channel }}
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.pin.outputs.channel }}
 
       - name: Install Node (for the connection-reader SEA bridge build)
         uses: actions/setup-node@v6