diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index 2668ec3..967fd0f 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -22,8 +22,14 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      # This pin currently carries a `toolchain: default: stable`, so it works
+      # today. State it anyway: a Dependabot SHA bump can land on a commit with
+      # NO default, at which point the job dies with `invalid toolchain name `
+      # and nothing in the diff explains why. See stress-test.yml.
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: stable
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
       - name: Run cargo audit
diff --git a/.github/workflows/db-checks.yml b/.github/workflows/db-checks.yml
index 027e7bc..3dca1ee 100644
--- a/.github/workflows/db-checks.yml
+++ b/.github/workflows/db-checks.yml
@@ -38,8 +38,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # This pin currently carries a `toolchain: default: stable`, so it works
+      # today. State it anyway: a Dependabot SHA bump can land on a commit with
+      # NO default, at which point the job dies with `invalid toolchain name `
+      # and nothing in the diff explains why. See stress-test.yml.
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: stable
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e7e4bc0..0180e89 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,9 +45,14 @@ jobs:
             binary: echidnabot.exe
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # ARMED, not yet fired: this pin's action.yml also has no `toolchain`
+      # default (see stress-test.yml for the full explanation). It only runs on
+      # a release, so it reads healthy until the moment it matters. publish.yml
+      # uses the same SHA and survives solely because it passes `toolchain:`.
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable
         with:
+          toolchain: stable
           targets: ${{ matrix.target }}
       - name: Install cross-compilation tools
         if: matrix.target == 'aarch64-unknown-linux-gnu'
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index 92999ef..957a0a2 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -11,8 +11,18 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      # dtolnay/rust-toolchain selects its toolchain from the REF it is
+      # referenced by (@stable, @1.91) -- each of those branches ships an
+      # action.yml carrying a matching `default:`. SHA-pinning removes that
+      # signal. MEASURED: this commit's action.yml has `toolchain: required:
+      # true` and NO default, so the job died with
+      #   error: invalid toolchain name ''
+      # The `# stable 1.91` comment beside the pin was therefore decoration,
+      # not fact. Passing `toolchain:` explicitly makes the pin genuinely inert.
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable 1.91
+        with:
+          toolchain: stable
 
       - name: Install stress testing tools
         run: |