diff --git a/.github/workflows/nix-bundle-rustfmt-evidence.yml b/.github/workflows/nix-bundle-rustfmt-evidence.yml
new file mode 100644
index 00000000..d0cdbb38
--- /dev/null
+++ b/.github/workflows/nix-bundle-rustfmt-evidence.yml
@@ -0,0 +1,111 @@
+name: external Nix bundle rustfmt evidence
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/nix-bundle-rustfmt-evidence.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: external-nix-bundle-rustfmt-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  evidence:
+    name: format exact production Nix bundle files / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, windows-2022, macos-13]
+    steps:
+      - name: Check out evidence workflow
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: harness
+          persist-credentials: false
+          show-progress: false
+
+      - name: Check out exact production commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: 1b282b94efc994bb9352b572c9652d5a078787f2
+          path: zed-cli
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install pinned rustfmt
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: stable
+          components: rustfmt
+
+      - name: Produce constrained exact bytes
+        working-directory: zed-cli
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = 1b282b94efc994bb9352b572c9652d5a078787f2
+          cargo fmt --all
+
+          python3 - <<'PY'
+          import subprocess
+
+          expected = {
+              'src/nix_bundle_write.rs',
+              'tests/nix_bundle_write_boundaries.rs',
+              'tests/nix_bundle_write_cli.rs',
+          }
+          changed = {
+              line.strip()
+              for line in subprocess.check_output(
+                  ['git', 'diff', '--name-only'], text=True
+              ).splitlines()
+              if line.strip()
+          }
+          if changed != expected:
+              raise SystemExit(
+                  'expected exactly the three reviewed files; got: '
+                  + ', '.join(sorted(changed))
+              )
+          PY
+
+          cargo fmt --all --check
+          cargo test --locked --test nix_bundle_write_cli --no-run
+          cargo test --locked --test nix_bundle_write_boundaries --no-run
+
+          mkdir -p "$RUNNER_TEMP/nix-bundle-rustfmt/src" \
+                   "$RUNNER_TEMP/nix-bundle-rustfmt/tests"
+          cp src/nix_bundle_write.rs \
+             "$RUNNER_TEMP/nix-bundle-rustfmt/src/nix_bundle_write.rs"
+          cp tests/nix_bundle_write_boundaries.rs \
+             "$RUNNER_TEMP/nix-bundle-rustfmt/tests/nix_bundle_write_boundaries.rs"
+          cp tests/nix_bundle_write_cli.rs \
+             "$RUNNER_TEMP/nix-bundle-rustfmt/tests/nix_bundle_write_cli.rs"
+          git diff --binary -- \
+            src/nix_bundle_write.rs \
+            tests/nix_bundle_write_boundaries.rs \
+            tests/nix_bundle_write_cli.rs \
+            > "$RUNNER_TEMP/nix-bundle-rustfmt/rustfmt.patch"
+          test -s "$RUNNER_TEMP/nix-bundle-rustfmt/rustfmt.patch"
+          sha256sum \
+            "$RUNNER_TEMP/nix-bundle-rustfmt/src/nix_bundle_write.rs" \
+            "$RUNNER_TEMP/nix-bundle-rustfmt/tests/nix_bundle_write_boundaries.rs" \
+            "$RUNNER_TEMP/nix-bundle-rustfmt/tests/nix_bundle_write_cli.rs" \
+            "$RUNNER_TEMP/nix-bundle-rustfmt/rustfmt.patch" \
+            > "$RUNNER_TEMP/nix-bundle-rustfmt/SHA256SUMS"
+          git diff --check
+
+      - name: Upload exact formatted files
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: nix-bundle-rustfmt-production-${{ runner.os }}-${{ github.run_id }}
+          path: ${{ runner.temp }}/nix-bundle-rustfmt
+          if-no-files-found: error
+          retention-days: 1
+          include-hidden-files: false