diff --git a/ci/sections.yml b/ci/sections.yml
index cb74becf3e..c256dc9d7b 100644
--- a/ci/sections.yml
+++ b/ci/sections.yml
@@ -1970,7 +1970,7 @@ jobs:
         run: |
           set -euo pipefail
           root=$(git rev-parse --show-toplevel)
-          ru=${RUSTUP_HOME:-$HOME/.rustup}; ca=$HOME/.cargo; tc=$(dirname "$(dirname "$(rustup which rustc --toolchain 1.93.0)")")
+          ru=${RUSTUP_HOME:-$HOME/.rustup}; ca=$HOME/.cargo; tc=$(readlink -f "$(dirname "$(dirname "$(rustup which rustc --toolchain 1.93.0)")")")
           ch=${CARGO_HOME:-$HOME/.cargo}
           sc=${SCCACHE_HOST_DIR:-$HOME/.cache/sccache}
           # pinned by digest, never :stable (pace condition 7); bump with the image
@@ -1984,18 +1984,20 @@ jobs:
           mkdir -p "$ch" "$sc"
           # one mount when CARGO_HOME is ~/.cargo (a second -v of the same target is a docker error)
           if [ "$ch" = "$ca" ]; then mounts=(-v "$ca:$ca"); else mounts=(-v "$ca:$ca:ro" -v "$ch:$ch"); fi
+          # a toolchain outside RUSTUP_HOME (linked, or a symlink target) is invisible in the container unless mounted: rustc then falls through to the rustup proxy
+          case "$tc" in "$ru"/*) tcm=() ;; *) tcm=(-v "$tc:$tc:ro") ;; esac
           snap=$(mktemp)
           cp "$root/Cargo.lock" "$snap"
           printf 'host rustc: %s\n' "$("$tc/bin/rustc" -vV | sed -n 1p)"
           # toolchain bin first in PATH: the rustup proxy writes settings.toml, and RUSTUP_HOME is mounted read-only
           docker run --rm --user "$(id -u):$(id -g)" \
-            -v "$root:$root" -w "$root" -v "$ru:$ru:ro" "${mounts[@]}" -v "$sc:/sccache" \
+            -v "$root:$root" -w "$root" -v "$ru:$ru:ro" ${tcm[@]+"${tcm[@]}"} "${mounts[@]}" -v "$sc:/sccache" -e TC="$tc" \
             -e HOME="$HOME" -e CARGO_HOME="$ch" -e RUSTUP_HOME="$ru" -e RUSTUP_TOOLCHAIN=1.93.0 -e RUSTFLAGS= -e CARGO_INCREMENTAL= \
             -e PATH="$tc/bin:$ca/bin:/usr/local/cargo/bin:/usr/bin:/bin" \
             -e RUSTC_WRAPPER=/usr/local/cargo/bin/sccache -e SCCACHE_DIR=/sccache \
             -e SCCACHE_CACHE_SIZE=50G \
             -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0="$root" \
-            "$img" bash -c 'set -e; printf "container build env: RUSTFLAGS=[%s] CARGO_INCREMENTAL=[%s]\n" "${RUSTFLAGS:-}" "${CARGO_INCREMENTAL:-}"; printf "container rustc: %s\n" "$(rustc -vV | sed -n 1p)"; t0=$(date +%s); cargo build -q -p aprender-contracts-cli --bin pv --bin pv-sat --features update-check,build-sha; printf "container pv build: %s s\n" "$(( $(date +%s) - t0 ))"; sccache --show-stats'
+            "$img" bash -c 'set -e; printf "container build env: RUSTFLAGS=[%s] CARGO_INCREMENTAL=[%s]\n" "${RUSTFLAGS:-}" "${CARGO_INCREMENTAL:-}"; [ "$(command -v rustc)" = "$TC/bin/rustc" ] || { echo "FAIL(ENV) the container resolves rustc to $(command -v rustc), not the pinned $TC/bin/rustc: the toolchain is not visible in the container"; exit 1; }; printf "container rustc: %s\n" "$(rustc -vV | sed -n 1p)"; t0=$(date +%s); cargo build -q -p aprender-contracts-cli --bin pv --bin pv-sat --features update-check,build-sha; printf "container pv build: %s s\n" "$(( $(date +%s) - t0 ))"; sccache --show-stats'
           if ! cmp -s "$snap" "$root/Cargo.lock"; then
             cp "$snap" "$root/Cargo.lock"
             echo "FAIL  the container build moved Cargo.lock (restored); run scripts/check_lockfile_current.sh"
diff --git a/docs/roadmaps/entries/PMAT-6041.yaml b/docs/roadmaps/entries/PMAT-6041.yaml
new file mode 100644
index 0000000000..8cd20e1794
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-6041.yaml
@@ -0,0 +1,19 @@
+- id: PMAT-6041
+  github_issue: 6041
+  item_type: task
+  title: 'ci: guard-cargo#m5 mounts a toolchain that lives outside RUSTUP_HOME and fails loud when the container does not run the pinned rustc'
+  status: in_progress
+  priority: high
+  assigned_to: null
+  created: 2026-10-23T00:55:00Z
+  updated: 2026-10-23T00:55:00Z
+  spec: null
+  acceptance_criteria:
+  - 'm5 resolves the pinned toolchain with readlink -f, mounts it when outside RUSTUP_HOME, and the container step fails with FAIL(ENV) naming the resolved rustc if it is not the pinned one'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: 5510
diff --git a/docs/roadmaps/roadmap.yaml b/docs/roadmaps/roadmap.yaml
index d106dc3edc..62a3702f11 100644
--- a/docs/roadmaps/roadmap.yaml
+++ b/docs/roadmaps/roadmap.yaml
@@ -25644,3 +25644,22 @@ Not done, pending the ruling: moving the 31 fixture files to an obviously synthe
   - kind:code
   notes: null
   epic: 3863
+- id: PMAT-6041
+  github_issue: 6041
+  item_type: task
+  title: 'ci: guard-cargo#m5 mounts a toolchain that lives outside RUSTUP_HOME and fails loud when the container does not run the pinned rustc'
+  status: in_progress
+  priority: high
+  assigned_to: null
+  created: 2026-10-23T00:55:00Z
+  updated: 2026-10-23T00:55:00Z
+  spec: null
+  acceptance_criteria:
+  - 'm5 resolves the pinned toolchain with readlink -f, mounts it when outside RUSTUP_HOME, and the container step fails with FAIL(ENV) naming the resolved rustc if it is not the pinned one'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: 5510