diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 00000000..08b4a599
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,7 @@
+# One pin for every side (main, 7 October 2026): the Mac, igneum-build-1 (provision.sh RUST_TOOLCHAIN reads this), the PCs and CI.
+# rustup resolves the nearest rust-toolchain.toml walking up from the crate, so the fork worktrees under vendor/ are covered by
+# this file and carry their own copy for the fork's standalone checkout. lib.sh bs_toolchain_check refuses a build when the pin,
+# the Mac's rustc or the box's rustc differ. Bump here and in vendor/igneum-node/rust-toolchain.toml in one commit each.
+[toolchain]
+channel = "1.99.0"
+targets = ["x86_64-pc-windows-gnu", "x86_64-unknown-linux-gnu"]