diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5dada1..aaaf281 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        # Pinned to match rust-toolchain.toml; bump both together.
+        uses: dtolnay/rust-toolchain@1.96.0
         with:
           components: clippy, rustfmt
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f2042c9..eba7c03 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,7 +50,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        # Pinned to match rust-toolchain.toml; bump both together.
+        uses: dtolnay/rust-toolchain@1.96.0
         with:
           targets: ${{ matrix.target }}
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..7a2a35c
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,7 @@
+# Pin the toolchain so local and CI never drift (a floating `stable` once
+# silently bumped clippy/rustfmt and broke CI on untouched code). Bump this
+# version deliberately, and keep the CI workflows' `dtolnay/rust-toolchain@<ver>`
+# in sync with it.
+[toolchain]
+channel = "1.96.0"
+components = ["rustfmt", "clippy"]