diff --git a/.github/workflows/rust-ci-reusable.yml b/.github/workflows/rust-ci-reusable.yml
index c0c021f2..8cc9ad52 100644
--- a/.github/workflows/rust-ci-reusable.yml
+++ b/.github/workflows/rust-ci-reusable.yml
@@ -149,8 +149,14 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` is mandatory because the action is pinned by commit SHA:
+        # dtolnay/rust-toolchain infers the toolchain from the `@`-ref (e.g.
+        # `@stable`), but a SHA ref carries no version, so the action's "parse
+        # toolchain version" step fails with `'toolchain' is a required input`.
+        # See standards estate-wide rust-ci red.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
         with:
+          toolchain: stable
           components: clippy, rustfmt
 
       - name: Cache cargo registry and build
@@ -190,7 +196,10 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` mandatory under SHA pin — see Cargo check job above.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
+        with:
+          toolchain: stable
 
       - name: Cache cargo registry and build
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
@@ -230,7 +239,10 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` mandatory under SHA pin — see Cargo check job above.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
+        with:
+          toolchain: stable
 
       - name: Install cargo-audit
         # Use the binstall path when available to skip a from-source rebuild
@@ -260,7 +272,10 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` mandatory under SHA pin — see Cargo check job above.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
+        with:
+          toolchain: stable
 
       - name: Install tarpaulin
         run: cargo install cargo-tarpaulin --locked