diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 84bb684..ed835dd 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,28 +5,29 @@ on:
       - main
   pull_request:
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_HOME: build/cargo-home
-  CARGO_TARGET_DIR: ${{ github.workspace }}/build/target
-
 jobs:
   build:
     env:
       RUST_LOG: debug
+      CARGO_TERM_COLOR: always
     name: Build
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v2
+      - name: Set up environment variables
+        run: |
+          echo "BUILD_DIR=${{ runner.temp }}/build" >> $GITHUB_ENV
+          echo "CARGO_HOME=${{ runner.temp }}/build/cargo-home" >> $GITHUB_ENV
+          echo "CARGO_TARGET_DIR=${{ runner.temp }}/build/target" >> $GITHUB_ENV
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - run: rustup install
       - run: rustup show active-toolchain
-      - run: rustup component add rustfmt clippy
 
       - name: Configure Rust cache
         uses: Swatinem/rust-cache@v2
         with:
-          workspaces: ". -> build/target"
-          cache-workspace-crates: true
+          workspaces: ". -> ${{ env.CARGO_TARGET_DIR }}"
 
       - name: Update apt cache
         run: sudo apt update
@@ -72,20 +73,19 @@ jobs:
           echo ~/.local/bin >> $GITHUB_PATH
 
       - name: Setup meson project
-        run: meson setup -Dprofile=development -Dcargo_locked=true build
+        run: meson setup -Dprofile=development -Dcargo_locked=true $BUILD_DIR
 
       - name: Build
-        run: ninja -C build
+        run: ninja -C $BUILD_DIR
 
       - name: Test
         # We have to use the --interactive flag because of some
         # weird issue with meson hanging after cargo exits due to the TestDBus.
         # Probably has to do with forking the test processes.
-        run: meson test --interactive
-        working-directory: build/
+        run: meson test -C $BUILD_DIR --interactive
 
       - name: Check clippy recommendations
-        run: cargo clippy --locked --workspace --all-features --target-dir build/target -- -Dwarnings
+        run: cargo clippy --locked --workspace --all-features -- -Dwarnings
 
       - name: Check formatting
         run: cargo fmt --all --check
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 22a26ff..f52030b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -111,17 +111,12 @@ spec.
 For Rust code, we use [rustfmt][] to ensure consistent formatting code and
 [clippy][] to catch common mistakes not caught by the compiler.
 
-```sh
-# if you don't have them installed, install or update the stable toolchain
-rustup install stable
-# … and install prebuilt rustfmt and clippy executables (available for most platforms)
-rustup component add rustfmt clippy
-```
+You can run `rustup install` in the repo directory to install the pinned version of
+the Rust toolchain and linting tools.
 
 Before committing your changes, run `cargo fmt` to format the code (if your
 editor / IDE isn't set up to run it automatically) and `cargo clippy` to run
-lints. You'll need to run this from each Cargo project (`credentialsd/`,
-`credentialsd-ui/`, `credentialsd-common/`).
+lints.
 
 For Python code, we use [ruff][].
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..59277fe
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.97.1"
+components = ["clippy", "rustfmt"]