diff --git a/flake.lock b/flake.lock
index d339b4d..9ec9152 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,7 +18,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786076960,
+        "narHash": "sha256-jfR6OhwurCKn1tREyfOcK/Omxf1Q/DzDDFbnEr1mBLs=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "57a23bfaf4f7017267294b161175db1e32eb1c85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 87ab119..faea896 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,18 +1,57 @@
 {
   description = "PeerSpeak — decentralized P2P voice chat (Rust/iroh/PipeWire/Opus/iced)";
 
-  # Pinned to the same channel the hosts run (nixos-config tracks nixos-26.05),
-  # so the libraries this shell links and dlopens are built against the same
-  # release as the PipeWire daemon and Vulkan ICD actually running on the
-  # machine. Floating to unstable here would reintroduce precisely the
-  # client/server version skew the pin exists to prevent.
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+  inputs = {
+    # Pinned to the same channel the hosts run (nixos-config tracks
+    # nixos-26.05), so the libraries this shell links and dlopens are built
+    # against the same release as the PipeWire daemon and Vulkan ICD actually
+    # running on the machine. Floating to unstable here would reintroduce
+    # precisely the client/server version skew the pin exists to prevent.
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+
+    # The Rust toolchain is pinned SEPARATELY from the system libraries, and
+    # deliberately so. nixpkgs 26.05 ships rustc 1.95.0, but this crate was
+    # developed and verified against 1.97.1 — close enough to build and pass
+    # every test, but not close enough for clippy, which flags a
+    # `collapsible_match` on 1.95 that 1.97 does not. Taking the compiler from
+    # here decouples "which Rust the project targets" from "which release the
+    # audio stack came from", so a nixpkgs bump can never silently move the
+    # compiler under the lint gate again.
+    #
+    # This is the reproducible alternative to rustup: same exact-version
+    # control, but the choice is recorded in flake.lock, so darp5 or a fresh
+    # clone resolves the identical toolchain instead of whatever rustup happens
+    # to fetch that day.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { nixpkgs, ... }:
+    { nixpkgs, rust-overlay, ... }:
     let
       system = "x86_64-linux";
-      pkgs = nixpkgs.legacyPackages.${system};
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ rust-overlay.overlays.default ];
+      };
+
+      # Matches what CachyOS shipped (rust 1:1.97.1-1), which is the toolchain
+      # every green result in the handoff was produced with.
+      #
+      # `default` is the rustup "default" profile — rustc, cargo, rust-std,
+      # rustfmt and clippy — so those are NOT listed separately below.
+      #
+      # rust-src and the windows-gnu target exist for win-cross-build.sh, which
+      # needs `-Z build-std=std,panic_abort` for the self-contained .exe. That
+      # script still expects to run in the peerspeak-win distrobox for the
+      # mingw toolchain; carrying the target here just means the Rust half is
+      # already in place if it is ever driven from the host.
+      rustToolchain = pkgs.rust-bin.stable."1.97.1".default.override {
+        extensions = [ "rust-src" ];
+        targets = [ "x86_64-pc-windows-gnu" ];
+      };
 
       # Libraries that iced/winit/wgpu open with dlopen at RUNTIME rather than
       # linking at build time. Because nothing links them, they never land in
@@ -53,12 +92,10 @@
     in
     {
       devShells.${system}.default = pkgs.mkShell {
-        nativeBuildInputs = with pkgs; [
-          rustc
-          cargo
-          rustfmt
-          clippy
-
+        nativeBuildInputs = [
+          rustToolchain
+        ]
+        ++ (with pkgs; [
           # The supply-chain gates .gitea/workflows/ci.yml runs, so the same
           # checks are reproducible locally before a push. These were `cargo
           # install`ed on the CachyOS side, which does not carry over — those
@@ -86,7 +123,7 @@
           # build.rs shells out to `git rev-parse --short=8 HEAD` to stamp
           # PEERSPEAK_GIT_SHORT into the binary (surfaced in Settings).
           git
-        ]
+        ])
         ++ screenshareTools
         ++ [
           pkgs.pulseaudio # `pactl`, used by pixelpass's audio routing