diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0f4d451..c24bc72 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -28,8 +28,8 @@ jobs:
 
       # Best-effort caches (act_runner's built-in cache server). Keyed on Cargo.lock:
       # registry/git are download caches, target/ the incremental build. The target key
-      # carries the rustc version — rust-toolchain.toml pins the floating "stable"
-      # channel, so the file alone wouldn't invalidate stale incremental state.
+      # carries the rustc version — resolved via `rustc --version` (below) rather than parsed
+      # from rust-toolchain.toml, so a pin bump there invalidates stale incremental state too.
       - name: Cache keys
         run: echo "rustc=$(rustc --version | cut -d' ' -f2)" >> "$GITHUB_ENV"
       - uses: actions/cache@v4
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 73cb934..72d7ad4 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,9 @@
+# Pin an EXACT version, not the floating "stable" channel. The CI image bakes whatever
+# `stable` was at image-build time; when the image is rebuilt onto a newer stable, rustfmt's
+# formatting rules shift and `cargo fmt --all --check` starts failing on files nobody touched
+# (format drift). An exact pin makes rustfmt/rustc identical for every contributor and CI, so
+# formatting only ever changes in a deliberate bump-this-line-and-reformat commit.
+# The CI image (ci/rust-ci.Dockerfile) and the Windows runner both use rustup, which honors this.
 [toolchain]
-channel = "stable"
+channel = "1.96.0"
 components = ["rustfmt", "clippy"]