diff --git a/.github/workflows/joule-code-conformance.yml b/.github/workflows/joule-code-conformance.yml
index c01e2844a..8a31362bb 100644
--- a/.github/workflows/joule-code-conformance.yml
+++ b/.github/workflows/joule-code-conformance.yml
@@ -25,10 +25,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: "1.97.1"
+      # Bootstrap rustup: the docker runner image ships no Rust, and
+      # dtolnay/rust-toolchain cannot help — it calls `rustup`, which is absent.
+      - name: Install Rust 1.97.1
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.97.1
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Cache cargo
         uses: actions/cache@v4
diff --git a/.github/workflows/jouleclaw-public-surface-documented.yml b/.github/workflows/jouleclaw-public-surface-documented.yml
index 2c0a203ee..17aedea06 100644
--- a/.github/workflows/jouleclaw-public-surface-documented.yml
+++ b/.github/workflows/jouleclaw-public-surface-documented.yml
@@ -33,10 +33,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Rust toolchain (workspace pin)
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: "1.97.1"
+      # Bootstrap rustup: the docker runner image ships no Rust, and
+      # dtolnay/rust-toolchain cannot help — it calls `rustup`, which is absent.
+      - name: Install Rust 1.97.1
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.97.1
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Cache cargo registry + target
         uses: actions/cache@v4
diff --git a/.github/workflows/wai-byte-equality.yml b/.github/workflows/wai-byte-equality.yml
index 92eac814c..e75a77b74 100644
--- a/.github/workflows/wai-byte-equality.yml
+++ b/.github/workflows/wai-byte-equality.yml
@@ -49,10 +49,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.97.1
+      # Bootstrap rustup: the docker runner image ships no Rust, and
+      # dtolnay/rust-toolchain cannot help — it calls `rustup`, which is absent.
+      - name: Install Rust 1.97.1
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.97.1
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Decode fixtures, assert golden bytes
         working-directory: wai/byte-exact-conformance
diff --git a/.github/workflows/wai-conformance.yml b/.github/workflows/wai-conformance.yml
index 61d351c5e..92d195bad 100644
--- a/.github/workflows/wai-conformance.yml
+++ b/.github/workflows/wai-conformance.yml
@@ -45,14 +45,18 @@ jobs:
         os: [linux, linux-arm64, macos, windows]
     steps:
       - uses: actions/checkout@v5
-      # The self-hosted macOS runner is a `host` executor started from launchd,
-      # whose PATH does not include ~/.cargo/bin — rustup is installed but not
-      # findable. Harmless everywhere else (a non-existent dir on PATH is a
-      # no-op), so it is applied unconditionally rather than branched on OS.
-      - name: Put cargo on PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Rust 1.97.1
-        run: rustup toolchain install 1.97.1 --profile minimal && rustup default 1.97.1
+      # Bootstraps rustup on the minimal docker image (linux / linux-arm64 /
+      # windows runners ship no Rust at all) and also covers the macOS `host`
+      # runner, whose launchd PATH omits ~/.cargo/bin. dtolnay/rust-toolchain
+      # is NOT usable here: it calls `rustup`, which the docker image lacks.
+      - name: Install Rust 1.97.1
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.97.1
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Build the cargo classes (pure Rust, no C codec chain)
         working-directory: wai/wai-rs
         # neural_int joins the pure-Rust set: the integer-synthesis decoder is
@@ -95,14 +99,18 @@ jobs:
         os: [linux, linux-arm64, macos, windows]
     steps:
       - uses: actions/checkout@v5
-      # The self-hosted macOS runner is a `host` executor started from launchd,
-      # whose PATH does not include ~/.cargo/bin — rustup is installed but not
-      # findable. Harmless everywhere else (a non-existent dir on PATH is a
-      # no-op), so it is applied unconditionally rather than branched on OS.
-      - name: Put cargo on PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Rust 1.97.1
-        run: rustup toolchain install 1.97.1 --profile minimal && rustup default 1.97.1
+      # Bootstraps rustup on the minimal docker image (linux / linux-arm64 /
+      # windows runners ship no Rust at all) and also covers the macOS `host`
+      # runner, whose launchd PATH omits ~/.cargo/bin. dtolnay/rust-toolchain
+      # is NOT usable here: it calls `rustup`, which the docker image lacks.
+      - name: Install Rust 1.97.1
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.97.1
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Integer rANS + int_synth + JPEG-AI mANS goldens (one machine → every machine)
         working-directory: wai/byte-exact-conformance
         run: cargo test --release
diff --git a/.github/workflows/wai-neural-e2e.yml b/.github/workflows/wai-neural-e2e.yml
index 531dd59de..2c6acd4d9 100644
--- a/.github/workflows/wai-neural-e2e.yml
+++ b/.github/workflows/wai-neural-e2e.yml
@@ -47,8 +47,15 @@ jobs:
       - name: Build the synthetic fixtures (elic / mlicpp / snac / dcvc / glc)
         working-directory: wai
         run: python tools/wai_validate_synthetic.py --size 256
-      - name: Rust 1.97.1
-        run: rustup toolchain install 1.97.1 --profile minimal && rustup default 1.97.1
+      # Bootstrap rustup: the docker runner image ships no Rust.
+      - name: Install Rust 1.97.1
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          command -v rustup >/dev/null 2>&1 || \
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.97.1
+          rustup toolchain install 1.97.1 --profile minimal
+          rustup default 1.97.1
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Each Rust decoder reproduces its reference end-to-end
         working-directory: wai/wai-rs
         # --no-default-features: the neural decoders need only `ort`, NOT the C