diff --git a/packaging/rpm/punktfunk.spec b/packaging/rpm/punktfunk.spec
index d186ccd..f816be8 100644
--- a/packaging/rpm/punktfunk.spec
+++ b/packaging/rpm/punktfunk.spec
@@ -157,6 +157,13 @@ runtime. Enable with `systemctl --user enable --now punktfunk-web`.
 # Release build of the host + client binaries (the workspace also has the core lib).
 # cargo fetches crates over the network; COPR build hosts allow this.
 export RUSTFLAGS="%{?build_rustflags}"
+# Use the toolchain baked into the builder image as-is, ignoring rust-toolchain.toml. The toml
+# floats `channel = "stable"` and requests rustfmt/clippy (lint-only — not needed for a build); when
+# a newer stable lands upstream, that combination makes rustup try to UPDATE the baked, minimal-
+# profile `stable` toolchain in place, and the in-image OverlayFS rejects the staging rename with
+# EXDEV ("Invalid cross-device link"), failing %build. RUSTUP_TOOLCHAIN bypasses the toml so rustup
+# neither re-resolves the channel nor adds components — it just builds with what's installed.
+export RUSTUP_TOOLCHAIN=stable
 # Stamp the exact NVR into the binary for --version / mgmt /health provenance (build.rs reads it).
 export PUNKTFUNK_BUILD_VERSION="%{version}-%{release}"
 # --locked: reproducible from (commit + Cargo.lock), matching the .deb build path.