diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8a556e38..e1e16f0b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,15 +9,27 @@ on:
 jobs:
   build-test:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        rust: [stable, '1.89.0']
     permissions:
       contents: read
     env:
       CARGO_TERM_COLOR: always
       BUILD_PROFILE: debug
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
+        with:
+          toolchain: ${{ matrix.rust }}
+          components: rustfmt, clippy
+      - name: Show rustc version
+        run: |
+          rustup show
+          rustc --version
+          cargo --version
       - name: Show Ninja version
         run: ninja --version
       - name: Format
@@ -27,16 +39,15 @@ jobs:
       - name: Test
         run: make test
       - name: Test and Measure Coverage
+        if: matrix.rust == 'stable'
         uses: leynos/shared-actions/.github/actions/generate-coverage@c6559452842af6a83b83429129dccaf910e34562
         with:
           output-path: lcov.info
           format: lcov
       - name: Upload coverage data to CodeScene
-        env:
-          CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }}
-        if: ${{ env.CS_ACCESS_TOKEN }}
+        if: matrix.rust == 'stable' && secrets.CS_ACCESS_TOKEN != ''
         uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@c6559452842af6a83b83429129dccaf910e34562
         with:
           format: lcov
-          access-token: ${{ env.CS_ACCESS_TOKEN }}
+          access-token: ${{ secrets.CS_ACCESS_TOKEN }}
           installer-checksum: ${{ vars.CODESCENE_CLI_SHA256 }}
diff --git a/.github/workflows/netsukefile-test.yml b/.github/workflows/netsukefile-test.yml
index 3a3b29aa..344d0198 100644
--- a/.github/workflows/netsukefile-test.yml
+++ b/.github/workflows/netsukefile-test.yml
@@ -9,22 +9,36 @@ on:
 jobs:
   netsukefile:
     runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        rust: [stable, '1.89.0']
     permissions:
       contents: read
+    env:
+      RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
+        with:
+          toolchain: ${{ matrix.rust }}
+      - name: Show rustc version
+        run: |
+          rustup show
+          rustc --version
+          cargo --version
       - name: Cache Cargo
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
         with:
+          # Do not cache build outputs when running make clean
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ matrix.rust }}-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
+            ${{ runner.os }}-cargo-${{ matrix.rust }}-
             ${{ runner.os }}-cargo-
       - name: Clean build artefacts
         run: make clean
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 32404452..473f0f01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,8 @@ env:
 
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -55,10 +57,10 @@ jobs:
 #            target: aarch64-unknown-openbsd
 #            ext: ""
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
       - name: Setup Python 3.11
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: '3.11'
       - name: Verify tag matches Cargo.toml
@@ -85,17 +87,28 @@ PY
           echo "Release tag $tag matches Cargo.toml version."
       - name: Setup Rust
         uses: leynos/shared-actions/.github/actions/setup-rust@c6559452842af6a83b83429129dccaf910e34562
+      - name: Install MSRV toolchain
+        run: rustup toolchain install 1.89.0
+      - name: Add MSRV release target
+        run: rustup +1.89.0 target add ${{ matrix.target }}
+      - name: Show Rust versions
+        run: |
+          rustup show
+          rustc +1.89.0 --version
+          rustc +stable --version
       - name: Cache cross binary
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809  # v4
         with:
           path: ~/.cargo/bin/cross
           key: cross-v0.2.5-${{ runner.os }}
       - name: Install cross
         env:
           RUSTFLAGS: ""
-        run: cargo install cross --git https://github.com/cross-rs/cross --tag v0.2.5
+        run: cargo install --locked cross --git https://github.com/cross-rs/cross --tag v0.2.5
+      - name: Verify MSRV build
+        run: cross +1.89.0 build --release --target ${{ matrix.target }}
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809  # v4
         with:
           path: |
             ~/.cargo/registry
@@ -105,7 +118,7 @@ PY
           restore-keys: |
             ${{ runner.os }}-cargo-
       - name: Add release target
-        run: rustup target add ${{ matrix.target }}
+        run: rustup +stable target add ${{ matrix.target }}
       - name: Build release binary
         run: cross +stable build --release --target ${{ matrix.target }}
       - name: Prepare artifact
@@ -116,20 +129,22 @@ PY
           sha256sum artifacts/${{ matrix.os }}-${{ matrix.arch }}/${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }} > \
             artifacts/${{ matrix.os }}-${{ matrix.arch }}/${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}.sha256
       - name: Upload release artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: ${{ env.REPO_NAME }}-${{ matrix.os }}-${{ matrix.arch }}
           path: artifacts/${{ matrix.os }}-${{ matrix.arch }}
 
   release:
     needs: build
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: softprops/action-gh-release@v1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      - uses: softprops/action-gh-release@26994186c0ac3ef5cae75ac16aa32e8153525f77  # v1
         with:
           generate_release_notes: true
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           path: artifacts
       - run: |
diff --git a/Cargo.toml b/Cargo.toml
index 7a929fbe..19dea0ff 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,6 +2,7 @@
 name = "netsuke"
 version = "0.1.0"
 edition = "2024"
+rust-version = "1.89.0"
 
 [dependencies]
 clap = { version = "4.5.0", features = ["derive"] }
diff --git a/ninja_env/Cargo.toml b/ninja_env/Cargo.toml
index 3b4262f9..07d1a54c 100644
--- a/ninja_env/Cargo.toml
+++ b/ninja_env/Cargo.toml
@@ -2,7 +2,7 @@
 name = "ninja_env"
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.85.0"
+rust-version = "1.89.0"
 publish = false
 
 [dependencies]
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 15373e12..908d2ecb 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "nightly-2025-06-26"
+channel = "1.89.0"
 components = ["rustfmt", "clippy"]
diff --git a/test_support/Cargo.toml b/test_support/Cargo.toml
index 81a6553d..dbba76e3 100644
--- a/test_support/Cargo.toml
+++ b/test_support/Cargo.toml
@@ -2,7 +2,7 @@
 name = "test_support"
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.85.0"
+rust-version = "1.89.0"
 publish = false
 
 [dependencies]