diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0dc2a8b4..4e0f5b98 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
       # rust-version = 1.88 is declared workspace-wide; verify the published
       # crates still compile on it. napi/wasm bindings are checked on stable
       # in their own jobs since their toolchain needs can differ.
-      - uses: dtolnay/rust-toolchain@2eae45db285e407f22119950686d47e1101e071b  # 1.88
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # 1.88
       # mds-python is added to the MSRV gate: its pyo3/abi3 build must compile on
       # the workspace floor (Rust 1.88 ≥ pyo3 0.28 MSRV 1.83). setup-python gives
       # the pyo3 build script a 3.11+ interpreter.
@@ -74,7 +74,7 @@ jobs:
       # Scoped to this job only (not repo-wide rust-toolchain.toml) to limit blast radius.
       # WHEN BUMPING: rebuild, re-measure with the new compiler, and update the
       # budget-history ledger comment above with the new baseline before changing the pin.
-      - uses: dtolnay/rust-toolchain@01ba1edad32c6f80dbcce879d3e0fa5a00b2a84e  # 1.96.0
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # 1.96.0
         with:
           targets: wasm32-unknown-unknown
       - uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b9f44818..08caf88d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -391,7 +391,7 @@ jobs:
       # drift silently push the binary past the 850 KB guard between releases.
       # WHEN BUMPING: update ci.yml's wasm job pin first, re-measure, then
       # update here to keep both in sync.
-      - uses: dtolnay/rust-toolchain@01ba1edad32c6f80dbcce879d3e0fa5a00b2a84e  # 1.96.0
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c  # 1.96.0
         with: { targets: wasm32-unknown-unknown }
       - uses: Swatinem/rust-cache@v2
       - uses: ./.github/actions/setup-wasm