diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee6c443cf..59915b492 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -260,7 +260,13 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
+      # rustup ships on every GitHub-hosted runner, so no third-party action
+      # installs the toolchain: dtolnay/rust-toolchain force-pushes the branch
+      # its SHA pin points into on every upstream change, which turns the pin
+      # into an impostor commit for zizmor.
+      - name: Install Rust stable
+        shell: bash
+        run: rustup toolchain install stable --profile minimal --no-self-update && rustup default stable
 
       - name: Install system dependencies
         # apt mirrors are flaky: a healthy run finishes in <1min, but a degraded
@@ -349,7 +355,10 @@ jobs:
         with:
           node-version-file: package.json
 
-      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
+      # Same direct rustup install as the smoketest above.
+      - name: Install Rust stable
+        shell: bash
+        run: rustup toolchain install stable --profile minimal --no-self-update && rustup default stable
 
       # Windows and macOS runners bill at a multiple of Linux, so the dependency
       # compile is cached rather than paid on every PR.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7270aa153..cfa89157c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,9 +56,14 @@ jobs:
       - name: Install workspace dependencies
         run: pnpm install --frozen-lockfile
 
-      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
-        with:
-          targets: ${{ matrix.target }}
+      # Direct rustup rather than an action; ci.yml's smoketest says why.
+      - name: Install Rust stable
+        shell: bash
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update --target "$TARGET"
+          rustup default stable
+        env:
+          TARGET: ${{ matrix.target }}
 
       # No Rust cache: a release build restores nothing a run on another ref
       # wrote, since the default branch's cache scope is reachable from every