diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..d5502a4
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,27 @@
+# Pinned toolchain — this workspace only builds inside a NARROW rustc band.
+#
+# Established empirically 2026-07-28 in a clean Debian 13 container:
+#
+#   rustc 1.85.0  (what `apt install rustc` gives on Debian trixie)
+#       -> FAILS: "rustc 1.85.0 is not supported by the following packages"
+#          aws-config, aws-sdk-*, aws-smithy-* all require >= 1.91.1
+#
+#   rustc 1.97.1  (what `rustup default stable` gives today)
+#       -> FAILS: ethnum, error[E0512] "cannot transmute between types of
+#          different sizes, or dependently-sized types"
+#
+#   rustc 1.94.0  -> builds clean (2m39s, workspace, exit 0)
+#
+# So BOTH obvious reviewer paths break: distro rustc is too old, rustup stable
+# is too new. Without this pin the build reproduced on our host only because the
+# toolchain happened to be restored from the previous machine. Pinning makes it
+# reproducible by construction rather than by accident.
+#
+# Native prerequisites (also verified in the clean container, minimal set):
+#   protobuf-compiler   -- lance-encoding / lance-file build scripts need protoc
+#   pkg-config
+#   libssl-dev
+# NOT required, despite being installed on the dev host: cmake, clang, libclang-dev.
+[toolchain]
+channel = "1.94.0"
+profile = "minimal"