diff --git a/flake.lock b/flake.lock
index d339b4d..9ec9152 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,7 +18,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786076960,
+        "narHash": "sha256-jfR6OhwurCKn1tREyfOcK/Omxf1Q/DzDDFbnEr1mBLs=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "57a23bfaf4f7017267294b161175db1e32eb1c85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 974edb9..498cbb3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,16 +1,44 @@
 {
   description = "PixelPass — P2P screen sharing CLI over iroh";
 
-  # Same channel the hosts run (nixos-config tracks nixos-26.05). The capture
-  # path talks to the live PipeWire daemon and the system PulseAudio server, so
-  # the client libraries here should come from the same release the server did.
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+  inputs = {
+    # Same channel the hosts run (nixos-config tracks nixos-26.05). The capture
+    # path talks to the live PipeWire daemon and the system PulseAudio server,
+    # so the client libraries here should come from the same release the server
+    # did.
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+
+    # The Rust toolchain is pinned SEPARATELY from the system libraries, so a
+    # nixpkgs bump cannot move the compiler under the lint gate. nixpkgs 26.05
+    # ships 1.95.0; this crate was developed and verified on 1.97.1, and
+    # peerspeak — the sibling project this one is built against — has a clippy
+    # lint that differs between exactly those two versions. Keeping both repos
+    # on one pinned compiler means a check that passes here passes there.
+    #
+    # This is the reproducible alternative to rustup: the same exact-version
+    # control, but recorded in flake.lock, so a fresh clone resolves the
+    # identical toolchain rather than whatever rustup fetches that day.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { nixpkgs, ... }:
+    { nixpkgs, rust-overlay, ... }:
     let
       system = "x86_64-linux";
-      pkgs = nixpkgs.legacyPackages.${system};
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ rust-overlay.overlays.default ];
+      };
+
+      # Matches what CachyOS shipped (rust 1:1.97.1-1) and what peerspeak pins.
+      # `default` is the rustup "default" profile — rustc, cargo, rust-std,
+      # rustfmt and clippy — so those are NOT listed separately below. No
+      # windows-gnu target here: pixelpass is Linux-only (portal/PipeWire/X11
+      # capture), unlike peerspeak which has a Windows port.
+      rustToolchain = pkgs.rust-bin.stable."1.97.1".default;
 
       # GStreamer is driven as a SUBPROCESS (gst-launch-1.0 / gst-inspect-1.0),
       # not linked — there is no gstreamer-sys in Cargo.lock. So these are PATH
@@ -41,13 +69,8 @@
     {
       devShells.${system}.default = pkgs.mkShell {
         nativeBuildInputs =
-          with pkgs;
-          [
-            rustc
-            cargo
-            rustfmt
-            clippy
-
+          [ rustToolchain ]
+          ++ (with pkgs; [
             # Debian packaging (`cargo deb --no-build`). Build the binary
             # inside a Debian/Ubuntu distrobox first so it links that distro's
             # glibc — see the packaging notes in Cargo.toml.
@@ -58,7 +81,7 @@
             # pipewire-sys, libspa-sys and libpulse-sys all generate bindings
             # with bindgen, which needs a real libclang at build time.
             clang
-          ]
+          ])
           ++ gstPlugins
           ++ [
             # The rest of what `deps::check_host_binaries` looks for.