From f50a3a9727416dfdac53b49884112bfc467f73a8 Mon Sep 17 00:00:00 2001
From: Simon Davies <simongdavies@users.noreply.github.com>
Date: Tue, 20 Oct 2026 16:44:51 +0100
Subject: [PATCH 1/5] Changes to allow different toolchains for host and guest

Host move to 1.99.1
Guest fixed at 1.94.1 until hyperlight target is upstreamed

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
---
 .devcontainer/Dockerfile                      |  9 +++--
 .github/workflows/CargoAudit.yml              |  2 -
 .github/workflows/CargoPublish.yml            |  4 +-
 .github/workflows/Coverage.yml                |  4 +-
 .github/workflows/CreateDevcontainerImage.yml | 26 +++++++++----
 .github/workflows/CreateRelease.yml           | 12 +++---
 .github/workflows/PrimeCaches.yml             |  4 +-
 .github/workflows/RegenSnapshotGoldens.yml    |  4 +-
 .github/workflows/RustNightly.yml             |  6 +--
 .github/workflows/ValidatePullRequest.yml     |  8 ++--
 .github/workflows/copilot-setup-steps.yml     | 12 +-----
 .github/workflows/dep_benchmarks.yml          |  4 +-
 .github/workflows/dep_build_guests.yml        | 16 ++++++--
 .github/workflows/dep_build_test.yml          |  4 +-
 .github/workflows/dep_code_checks.yml         | 12 +++---
 .github/workflows/dep_fuzzing.yml             |  4 +-
 .github/workflows/dep_miri.yml                |  4 +-
 .github/workflows/dep_run_examples.yml        |  4 +-
 .github/workflows/dep_update_guest_locks.yml  |  4 +-
 CONTRIBUTING.md                               | 15 ++++++++
 flake.nix                                     | 37 +++++++++++++++----
 rust-toolchain.toml                           |  7 ++--
 src/hyperlight_component_util/src/emit.rs     |  2 +-
 src/hyperlight_component_util/src/rtypes.rs   |  2 +-
 src/hyperlight_component_util/src/util.rs     |  2 +-
 src/hyperlight_guest_capi/rust-toolchain.toml |  6 +++
 src/hyperlight_host/build.rs                  |  2 +-
 .../tests/sandbox_host_tests.rs               |  1 -
 .../src/tracing_subscriber.rs                 |  4 +-
 src/tests/rust_guests/rust-toolchain.toml     |  6 +++
 30 files changed, 144 insertions(+), 83 deletions(-)
 create mode 100644 src/hyperlight_guest_capi/rust-toolchain.toml
 create mode 100644 src/tests/rust_guests/rust-toolchain.toml

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index b14463c4a0..10d2ab3c07 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -49,14 +49,15 @@ RUN SNIPPET="export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhisto
 
 USER $USER
 
-ARG RUST_TOOLCHAIN=1.94
+ARG RUST_TOOLCHAIN=1.99.1
+ARG GUEST_RUST_TOOLCHAIN=1.94.1
 
 # Install rust
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     && rustup default ${RUST_TOOLCHAIN} \
-    && rustup target add x86_64-unknown-linux-gnu \
-    && rustup target add x86_64-unknown-linux-musl \
-    && rustup target add x86_64-unknown-none      \
+    && rustup component add clippy rustfmt --toolchain ${RUST_TOOLCHAIN} \
+    && rustup target add x86_64-unknown-linux-gnu x86_64-unknown-linux-musl --toolchain ${RUST_TOOLCHAIN} \
+    && rustup toolchain install ${GUEST_RUST_TOOLCHAIN} --component clippy,rustfmt,rust-src --target x86_64-unknown-none \
     && rustup toolchain add nightly-2026-09-22-x86_64-unknown-linux-gnu \
     && cargo install just \
     && cargo install cross --locked --version 0.2.5
diff --git a/.github/workflows/CargoAudit.yml b/.github/workflows/CargoAudit.yml
index 9150ad99a3..d3b7dbb191 100644
--- a/.github/workflows/CargoAudit.yml
+++ b/.github/workflows/CargoAudit.yml
@@ -18,8 +18,6 @@ jobs:
       # We are not using the common workflow here because it installs a bunch of tools we don't need.
       # TODO: Once the runner image is updated to include the necessary tools (without downloading), we can switch to the common workflow.
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
-        with:
-          toolchain: "1.94"
 
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998  # v2.0.0
         with:
diff --git a/.github/workflows/CargoPublish.yml b/.github/workflows/CargoPublish.yml
index 68b89ef310..2675ecc66f 100644
--- a/.github/workflows/CargoPublish.yml
+++ b/.github/workflows/CargoPublish.yml
@@ -38,9 +38,9 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
 
       - name: Check crate versions
         shell: bash
diff --git a/.github/workflows/Coverage.yml b/.github/workflows/Coverage.yml
index 39a77f110d..6e60ad04d8 100644
--- a/.github/workflows/Coverage.yml
+++ b/.github/workflows/Coverage.yml
@@ -38,9 +38,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/CreateDevcontainerImage.yml b/.github/workflows/CreateDevcontainerImage.yml
index abd86d9d36..a9709ebae1 100644
--- a/.github/workflows/CreateDevcontainerImage.yml
+++ b/.github/workflows/CreateDevcontainerImage.yml
@@ -8,6 +8,8 @@ on:
       - ".devcontainer/Dockerfile"
       - ".github/workflows/CreateDevcontainerImage.yml"
       - "rust-toolchain.toml"
+      - "src/tests/rust_guests/rust-toolchain.toml"
+      - "src/hyperlight_guest_capi/rust-toolchain.toml"
 
 # Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
 env:
@@ -16,8 +18,6 @@ env:
   USER: vscode
   GROUP: vscode
   LLVM_VERSION: 18
-  RUST_TOOLCHAIN_DEFAULT: 1.94
-  RUST_TOOLCHAIN_FILE: rust-toolchain.toml
 
 # There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
 jobs:
@@ -32,13 +32,24 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Read Rust toolchain version from ${{ env.RUST_TOOLCHAIN_FILE }}
+      - name: Read Rust toolchain versions
         id: toolchain
         run: |
-          version=$(cat ${{ env.RUST_TOOLCHAIN_FILE }} | sed -n '/\[toolchain\]/,/^\[/{/^\s*channel = /s/[^"]*"\([^"]*\)".*/\1/p}')
-          cat ${{ env.RUST_TOOLCHAIN_FILE }} | grep $version &> /dev/null \
-            && echo "RUST_TOOLCHAIN=${version}" >> "$GITHUB_OUTPUT" \
-            || echo "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN_FILE }}" >> "$GITHUB_OUTPUT"
+          python3 - <<'PY'
+          import os
+          import tomllib
+
+          def channel(path):
+              with open(path, "rb") as source:
+                  return tomllib.load(source)["toolchain"]["channel"]
+
+          guest = channel("src/tests/rust_guests/rust-toolchain.toml")
+          if guest != channel("src/hyperlight_guest_capi/rust-toolchain.toml"):
+              raise ValueError("Guest Rust toolchains must match")
+          with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+              print(f"RUST_TOOLCHAIN={channel('rust-toolchain.toml')}", file=output)
+              print(f"GUEST_RUST_TOOLCHAIN={guest}", file=output)
+          PY
         
       # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
       - name: Log in to the Container registry
@@ -69,3 +80,4 @@ jobs:
             GROUP=${{ env.GROUP }}
             LLVM_VERSION=${{ env.LLVM_VERSION }}
             RUST_TOOLCHAIN=${{ steps.toolchain.outputs.RUST_TOOLCHAIN }}
+            GUEST_RUST_TOOLCHAIN=${{ steps.toolchain.outputs.GUEST_RUST_TOOLCHAIN }}
diff --git a/.github/workflows/CreateRelease.yml b/.github/workflows/CreateRelease.yml
index dc7f3d04ec..defbe1e2ab 100644
--- a/.github/workflows/CreateRelease.yml
+++ b/.github/workflows/CreateRelease.yml
@@ -35,9 +35,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -56,9 +56,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -134,9 +134,9 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
diff --git a/.github/workflows/PrimeCaches.yml b/.github/workflows/PrimeCaches.yml
index 46ac63ff25..3d94d287d6 100644
--- a/.github/workflows/PrimeCaches.yml
+++ b/.github/workflows/PrimeCaches.yml
@@ -96,9 +96,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/RegenSnapshotGoldens.yml b/.github/workflows/RegenSnapshotGoldens.yml
index 5b4e18ddb8..87608f20fa 100644
--- a/.github/workflows/RegenSnapshotGoldens.yml
+++ b/.github/workflows/RegenSnapshotGoldens.yml
@@ -171,9 +171,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/RustNightly.yml b/.github/workflows/RustNightly.yml
index 2cb61c365f..fd2e7fbaaf 100644
--- a/.github/workflows/RustNightly.yml
+++ b/.github/workflows/RustNightly.yml
@@ -44,9 +44,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -59,7 +59,7 @@ jobs:
           path: |
             src/tests/rust_guests/target/sysroot
             src/tests/rust_guests/target-non-pie/sysroot
-          key: sysroot-linux-${{ matrix.config }}-${{ hashFiles('rust-toolchain.toml') }}
+          key: sysroot-linux-${{ matrix.config }}-${{ hashFiles('src/tests/rust_guests/rust-toolchain.toml', 'src/hyperlight_guest_capi/rust-toolchain.toml') }}
 
       - name: Rust cache
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
diff --git a/.github/workflows/ValidatePullRequest.yml b/.github/workflows/ValidatePullRequest.yml
index 4491536005..baf81a6f06 100644
--- a/.github/workflows/ValidatePullRequest.yml
+++ b/.github/workflows/ValidatePullRequest.yml
@@ -111,9 +111,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -317,9 +317,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index e9bf6f3a8a..30003ba0f4 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -21,16 +21,8 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      # For rust-fmt 
-      - name: Set up nightly rust 
-        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          toolchain: nightly
-          components: rustfmt
-          
-
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94" 
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/dep_benchmarks.yml b/.github/workflows/dep_benchmarks.yml
index a40ff51ef7..17bc11af79 100644
--- a/.github/workflows/dep_benchmarks.yml
+++ b/.github/workflows/dep_benchmarks.yml
@@ -75,9 +75,9 @@ jobs:
           # The baseline pass checks out another commit, which needs its history.
           fetch-depth: ${{ inputs.baseline_ref == '' && 1 || 0 }}
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_build_guests.yml b/.github/workflows/dep_build_guests.yml
index d2d6c9976f..2e0dab6b7a 100644
--- a/.github/workflows/dep_build_guests.yml
+++ b/.github/workflows/dep_build_guests.yml
@@ -74,9 +74,19 @@ jobs:
           }
           git checkout --detach ${{ inputs.ref }}
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - name: Select guest toolchain
+        id: guest-toolchain
+        run: |
+          # Older commits use the root toolchain for both host and guests.
+          if [[ -f src/tests/rust_guests/rust-toolchain.toml ]]; then
+            echo "directory=src/tests/rust_guests" >> "$GITHUB_OUTPUT"
+          else
+            echo "directory=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: ${{ steps.guest-toolchain.outputs.directory }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -90,7 +100,7 @@ jobs:
           path: |
             src/tests/rust_guests/target/sysroot
             src/tests/rust_guests/target-non-pie/sysroot
-          key: sysroot-linux-${{ inputs.arch }}-${{ inputs.config }}-${{ hashFiles('rust-toolchain.toml') }}
+          key: sysroot-linux-${{ inputs.arch }}-${{ inputs.config }}-${{ hashFiles('rust-toolchain.toml', 'src/tests/rust_guests/rust-toolchain.toml', 'src/hyperlight_guest_capi/rust-toolchain.toml') }}
 
       - name: Rust cache
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
diff --git a/.github/workflows/dep_build_test.yml b/.github/workflows/dep_build_test.yml
index 12f75fb877..17d64353e2 100644
--- a/.github/workflows/dep_build_test.yml
+++ b/.github/workflows/dep_build_test.yml
@@ -84,9 +84,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_code_checks.yml b/.github/workflows/dep_code_checks.yml
index 28d239339d..87165fb054 100644
--- a/.github/workflows/dep_code_checks.yml
+++ b/.github/workflows/dep_code_checks.yml
@@ -35,9 +35,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94" 
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -50,7 +50,7 @@ jobs:
         with:
           path: |
             src/tests/rust_guests/target/sysroot
-          key: sysroot-linux-${{ hashFiles('rust-toolchain.toml') }}
+          key: sysroot-linux-${{ hashFiles('src/tests/rust_guests/rust-toolchain.toml', 'src/hyperlight_guest_capi/rust-toolchain.toml') }}
 
       - name: Rust cache
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
@@ -121,9 +121,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94" 
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -136,7 +136,7 @@ jobs:
         with:
           path: |
             src/tests/rust_guests/target/sysroot
-          key: sysroot-windows-${{ hashFiles('rust-toolchain.toml') }}
+          key: sysroot-windows-${{ hashFiles('src/tests/rust_guests/rust-toolchain.toml', 'src/hyperlight_guest_capi/rust-toolchain.toml') }}
 
       - name: Rust cache
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
diff --git a/.github/workflows/dep_fuzzing.yml b/.github/workflows/dep_fuzzing.yml
index fda29a1cd9..8bd2a0a6ad 100644
--- a/.github/workflows/dep_fuzzing.yml
+++ b/.github/workflows/dep_fuzzing.yml
@@ -51,9 +51,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_miri.yml b/.github/workflows/dep_miri.yml
index 858e5b6ed8..1deea5640d 100644
--- a/.github/workflows/dep_miri.yml
+++ b/.github/workflows/dep_miri.yml
@@ -50,9 +50,9 @@ jobs:
       # The shared setup reads /dev/kvm to report what the runner offers, which
       # a hosted one need not have. Miri wants a toolchain and two tools, so it
       # asks for those rather than everything a hypervisor job needs.
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8  # master
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
-          toolchain: "1.94"
+          cache: "false"
 
       - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29  # v2.87.21
         with:
diff --git a/.github/workflows/dep_run_examples.yml b/.github/workflows/dep_run_examples.yml
index 03ea8b2ee4..9265538387 100644
--- a/.github/workflows/dep_run_examples.yml
+++ b/.github/workflows/dep_run_examples.yml
@@ -62,9 +62,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_update_guest_locks.yml b/.github/workflows/dep_update_guest_locks.yml
index 8e45f307ec..1c5ea876d1 100644
--- a/.github/workflows/dep_update_guest_locks.yml
+++ b/.github/workflows/dep_update_guest_locks.yml
@@ -50,9 +50,9 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+        uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d6a9c586c8..b340c64d12 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -118,3 +118,18 @@ For more detailed instructions on setting up GPG signing, see [GitHub's document
 ### Rust Analyzer
 
 If you are using the [Rust Analyzer](https://rust-analyzer.github.io/manual.html) then you may need to set the configuration option `rust-analyzer.rustfmt.extraArgs` to `["+nightly"]` to ensure that formatting works correctly as this project has a [`rustfmt.toml`](./rustfmt.toml) file that uses nightly features.
+
+### Rust toolchains
+
+The root `rust-toolchain.toml` pins the rust version for host builds and tools.
+
+Rust guests and the C API use Rust 1.94.1, pinned in
+`src/tests/rust_guests/rust-toolchain.toml` and
+`src/hyperlight_guest_capi/rust-toolchain.toml`. These files should be kept in sync.
+
+Stable Rust 1.95+ requires an upstream Hyperlight target to build guests.
+
+Run `just build` for the host and `just guests` for the guests. The guest recipes
+change directories so rustup selects the guest toolchain. A `cargo --manifest-path`
+argument alone does not select a toolchain. Run direct guest Cargo commands from
+the guest directory.
diff --git a/flake.nix b/flake.nix
index 7adeb4641e..693e42e33c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -91,9 +91,14 @@
           # for rustfmt and old toolchains to verify MSRV
           toolchains = lib.mapAttrs (_: customisedRustChannelOf) {
             stable = {
-              date = "2026-03-05";
+              date = "2026-10-15";
               channel = "stable";
-              sha256 = "sha256-qqF33vNuAdU5vua96VKVIwuc43j4EFeEXbjQ6+l4mO4=";
+              sha256 = "fb152be80975c194aa5fc684b2aec3a6e14e2b855efe2faa4e5f8ae6e590f463";
+            };
+            "1.94.1" = {
+              date = "2026-03-26";
+              channel = "stable";
+              sha256 = "cc2f04dfc883549d683c8cc2a9393f523a3dfbd931f5d5eaef00303cca64a60d";
             };
             nightly = {
               date = "2026-09-22";
@@ -201,19 +206,37 @@
           rustup-like-wrapper = name: pkgs.writeShellScriptBin name
             (let
               clause = name: toolchain: ''
-                +${name}) base="${toolchain.rust}"; shift 1; ;;
-                +${name}-${toolchain.rust.toolchainVersionAttrs.date}) base="${toolchain.rust}"; shift 1; ;;
+                +${name}) base="${toolchain.rust}"; ;;
+                +${name}-${toolchain.rust.toolchainVersionAttrs.date}) base="${toolchain.rust}"; ;;
               '';
               clauses = lib.strings.concatStringsSep "\n"
                 (lib.mapAttrsToList clause toolchains);
             in ''
               base="${toolchains.stable.rust}"
-              ${materialiseDeps}
-              case "$1" in
+              requested="''${RUSTUP_TOOLCHAIN:-}"
+              if [[ "$1" == +* ]]; then
+                requested="''${1#+}"
+                shift
+              elif [[ -z "$requested" ]]; then
+                dir="$PWD"
+                while [[ "$dir" != / ]]; do
+                  if [[ -f "$dir/rust-toolchain.toml" ]]; then
+                    requested=$(sed -n 's/^channel = "\([^"]*\)".*/\1/p' "$dir/rust-toolchain.toml")
+                    break
+                  fi
+                  dir=$(dirname "$dir")
+                done
+              fi
+              case "+$requested" in
                 ${clauses}
-                install) exit 0; ;;
+                +1.99.1) base="${toolchains.stable.rust}"; ;;
+                +) requested=stable; ;;
+                *) echo "Unsupported Rust toolchain: $requested" >&2; exit 1; ;;
               esac
+              if [[ "$1" == install ]]; then exit 0; fi
+              export RUSTUP_TOOLCHAIN="$requested"
               export PATH="$base/bin:$PATH"
+              ${materialiseDeps}
               exec "$base/bin/${name}" "$@"
             '');
           fake-rustup = pkgs.symlinkJoin {
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index b7d7d69a20..c06779b4e1 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,5 +1,4 @@
 [toolchain]
-channel = "1.94"
-# Target used for guest binaries. This is an additive list of targets in addition to host platform.
-# Will install the target if not already installed when building guest binaries.
-targets = ["x86_64-unknown-none", "x86_64-unknown-linux-musl"]
+channel = "1.99.1"
+components = ["clippy", "rustfmt"]
+targets = ["x86_64-unknown-linux-musl"]
diff --git a/src/hyperlight_component_util/src/emit.rs b/src/hyperlight_component_util/src/emit.rs
index 80faf14db0..96f5f45deb 100644
--- a/src/hyperlight_component_util/src/emit.rs
+++ b/src/hyperlight_component_util/src/emit.rs
@@ -155,7 +155,7 @@ impl Trait {
     }
     /// See [`State::adjust_vars`].
     pub fn adjust_vars(&mut self, n: u32) {
-        for (_, (v, _)) in self.tvs.iter_mut() {
+        for (v, _) in self.tvs.values_mut() {
             if let Some(v) = v.as_mut() {
                 *v += n;
             }
diff --git a/src/hyperlight_component_util/src/rtypes.rs b/src/hyperlight_component_util/src/rtypes.rs
index 2342af8055..3e0ef4ca08 100644
--- a/src/hyperlight_component_util/src/rtypes.rs
+++ b/src/hyperlight_component_util/src/rtypes.rs
@@ -864,7 +864,7 @@ fn emit_instance<'a, 'b, 'c>(s: &'c mut State<'a, 'b>, wn: WitName, it: &'c Inst
         let mut stvs = BTreeMap::new();
         let _ = sv.cur_trait(); // make sure it exists
         let t = sv.cur_trait_immut();
-        for (ti, _) in t.supertraits.iter() {
+        for ti in t.supertraits.keys() {
             let t = sv.resolve_trait_immut(false, ti);
             stvs.insert(ti.clone(), t.tv_idxs());
         }
diff --git a/src/hyperlight_component_util/src/util.rs b/src/hyperlight_component_util/src/util.rs
index a013564a92..c3caddc99c 100644
--- a/src/hyperlight_component_util/src/util.rs
+++ b/src/hyperlight_component_util/src/util.rs
@@ -145,7 +145,7 @@ pub fn emit_decls(decls: proc_macro2::TokenStream, for_kebab: &str) -> proc_macr
         if let Ok(file) = syn::parse2(decls.clone()) {
             std::fs::write(&dbg_out, prettyplease::unparse(&file)).unwrap();
         } else {
-            let decls = format!("{}", &decls);
+            let decls = format!("{}", decls);
             std::fs::write(&dbg_out, &decls).unwrap();
         }
         quote::quote! { include!(#dbg_out); }
diff --git a/src/hyperlight_guest_capi/rust-toolchain.toml b/src/hyperlight_guest_capi/rust-toolchain.toml
new file mode 100644
index 0000000000..4ab1bad18d
--- /dev/null
+++ b/src/hyperlight_guest_capi/rust-toolchain.toml
@@ -0,0 +1,6 @@
+[toolchain]
+# Stable Rust 1.95+ requires an upstream Hyperlight target.
+# Keep this file in sync with src/tests/rust_guests/rust-toolchain.toml.
+channel = "1.94.1"
+components = ["clippy", "rustfmt", "rust-src"]
+targets = ["x86_64-unknown-none"]
diff --git a/src/hyperlight_host/build.rs b/src/hyperlight_host/build.rs
index bd9f15b1da..6326b429d2 100644
--- a/src/hyperlight_host/build.rs
+++ b/src/hyperlight_host/build.rs
@@ -85,7 +85,7 @@ fn main() -> Result<()> {
 
         println!(
             "cargo:rustc-env=HYPERLIGHT_SURROGATE_DIR={}",
-            &surrogate_binary_dir.display()
+            surrogate_binary_dir.display()
         );
     }
 
diff --git a/src/hyperlight_host/tests/sandbox_host_tests.rs b/src/hyperlight_host/tests/sandbox_host_tests.rs
index 6421fa5b3e..241e196f2c 100644
--- a/src/hyperlight_host/tests/sandbox_host_tests.rs
+++ b/src/hyperlight_host/tests/sandbox_host_tests.rs
@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2025 The Hyperlight Authors.
-use core::f64;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::mpsc::channel;
 use std::sync::{Arc, Mutex};
diff --git a/src/hyperlight_testing/src/tracing_subscriber.rs b/src/hyperlight_testing/src/tracing_subscriber.rs
index dee66b1ff3..8ae8849710 100644
--- a/src/hyperlight_testing/src/tracing_subscriber.rs
+++ b/src/hyperlight_testing/src/tracing_subscriber.rs
@@ -133,7 +133,7 @@ impl Subscriber for TracingSubscriber {
             println!(
                 "Thread {:?} span {} values: {}",
                 std::thread::current().id(),
-                &span_id,
+                span_id,
                 to_string_pretty(&json_values).expect("Failed to pretty print json")
             );
             let json_values = json_values
@@ -152,7 +152,7 @@ impl Subscriber for TracingSubscriber {
             println!(
                 "Thread {:?} Updated Span {} values: {}",
                 std::thread::current().id(),
-                &span_id,
+                span_id,
                 to_string_pretty(&json_object).expect("Failed to pretty print json")
             );
         });
diff --git a/src/tests/rust_guests/rust-toolchain.toml b/src/tests/rust_guests/rust-toolchain.toml
new file mode 100644
index 0000000000..4ffe96e56b
--- /dev/null
+++ b/src/tests/rust_guests/rust-toolchain.toml
@@ -0,0 +1,6 @@
+[toolchain]
+# Stable Rust 1.95+ requires an upstream Hyperlight target.
+# Keep this file in sync with src/hyperlight_guest_capi/rust-toolchain.toml.
+channel = "1.94.1"
+components = ["clippy", "rustfmt", "rust-src"]
+targets = ["x86_64-unknown-none"]

From 225c7b5ec274454a87f026e56515104ea5c99dc6 Mon Sep 17 00:00:00 2001
From: Simon Davies <simongdavies@users.noreply.github.com>
Date: Tue, 20 Oct 2026 21:06:55 +0100
Subject: [PATCH 2/5] Update to version 2.1.0 of the common wokflow and other
 fixes

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
---
 .github/workflows/CargoPublish.yml           |  2 +-
 .github/workflows/Coverage.yml               |  3 ++-
 .github/workflows/CreateRelease.yml          |  6 +++---
 .github/workflows/PrimeCaches.yml            |  2 +-
 .github/workflows/RegenSnapshotGoldens.yml   |  2 +-
 .github/workflows/RustNightly.yml            |  3 ++-
 .github/workflows/ValidatePullRequest.yml    |  4 ++--
 .github/workflows/copilot-setup-steps.yml    |  2 +-
 .github/workflows/dep_benchmarks.yml         |  2 +-
 .github/workflows/dep_build_guests.yml       |  3 ++-
 .github/workflows/dep_build_test.yml         |  2 +-
 .github/workflows/dep_code_checks.yml        |  4 ++--
 .github/workflows/dep_fuzzing.yml            |  2 +-
 .github/workflows/dep_miri.yml               |  2 ++
 .github/workflows/dep_run_examples.yml       |  2 +-
 .github/workflows/dep_update_guest_locks.yml |  2 +-
 src/hyperlight_guest_bin/src/libc_stubs.rs   | 14 ++++++++++++++
 src/hyperlight_libc/build.rs                 |  8 +++++---
 18 files changed, 43 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/CargoPublish.yml b/.github/workflows/CargoPublish.yml
index 2675ecc66f..27939109a9 100644
--- a/.github/workflows/CargoPublish.yml
+++ b/.github/workflows/CargoPublish.yml
@@ -38,7 +38,7 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
 
diff --git a/.github/workflows/Coverage.yml b/.github/workflows/Coverage.yml
index 6e60ad04d8..e378089e71 100644
--- a/.github/workflows/Coverage.yml
+++ b/.github/workflows/Coverage.yml
@@ -13,6 +13,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_PROFILE_DEV_DEBUG: "2"
   RUST_BACKTRACE: full
 
 permissions:
@@ -38,7 +39,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/CreateRelease.yml b/.github/workflows/CreateRelease.yml
index defbe1e2ab..e2c4f0af18 100644
--- a/.github/workflows/CreateRelease.yml
+++ b/.github/workflows/CreateRelease.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
@@ -56,7 +56,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
@@ -134,7 +134,7 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/PrimeCaches.yml b/.github/workflows/PrimeCaches.yml
index 3d94d287d6..76439db399 100644
--- a/.github/workflows/PrimeCaches.yml
+++ b/.github/workflows/PrimeCaches.yml
@@ -96,7 +96,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/RegenSnapshotGoldens.yml b/.github/workflows/RegenSnapshotGoldens.yml
index 87608f20fa..77afd0ba75 100644
--- a/.github/workflows/RegenSnapshotGoldens.yml
+++ b/.github/workflows/RegenSnapshotGoldens.yml
@@ -171,7 +171,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/RustNightly.yml b/.github/workflows/RustNightly.yml
index fd2e7fbaaf..0d4adfa875 100644
--- a/.github/workflows/RustNightly.yml
+++ b/.github/workflows/RustNightly.yml
@@ -13,6 +13,7 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_PROFILE_DEV_DEBUG: "2"
   RUST_BACKTRACE: full
 
 defaults:
@@ -44,7 +45,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/ValidatePullRequest.yml b/.github/workflows/ValidatePullRequest.yml
index baf81a6f06..d20af0276c 100644
--- a/.github/workflows/ValidatePullRequest.yml
+++ b/.github/workflows/ValidatePullRequest.yml
@@ -111,7 +111,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
@@ -317,7 +317,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 30003ba0f4..b47dfcf0dc 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_benchmarks.yml b/.github/workflows/dep_benchmarks.yml
index 17bc11af79..ba8cce2135 100644
--- a/.github/workflows/dep_benchmarks.yml
+++ b/.github/workflows/dep_benchmarks.yml
@@ -75,7 +75,7 @@ jobs:
           # The baseline pass checks out another commit, which needs its history.
           fetch-depth: ${{ inputs.baseline_ref == '' && 1 || 0 }}
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_build_guests.yml b/.github/workflows/dep_build_guests.yml
index 2e0dab6b7a..6149058c2a 100644
--- a/.github/workflows/dep_build_guests.yml
+++ b/.github/workflows/dep_build_guests.yml
@@ -33,6 +33,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_PROFILE_DEV_DEBUG: "2"
 
 permissions:
   contents: read
@@ -84,7 +85,7 @@ jobs:
             echo "directory=" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: ${{ steps.guest-toolchain.outputs.directory }}
         env:
diff --git a/.github/workflows/dep_build_test.yml b/.github/workflows/dep_build_test.yml
index 17d64353e2..bd2cf4431d 100644
--- a/.github/workflows/dep_build_test.yml
+++ b/.github/workflows/dep_build_test.yml
@@ -84,7 +84,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_code_checks.yml b/.github/workflows/dep_code_checks.yml
index 87165fb054..53eb570457 100644
--- a/.github/workflows/dep_code_checks.yml
+++ b/.github/workflows/dep_code_checks.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
@@ -121,7 +121,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_fuzzing.yml b/.github/workflows/dep_fuzzing.yml
index 8bd2a0a6ad..d3633ea682 100644
--- a/.github/workflows/dep_fuzzing.yml
+++ b/.github/workflows/dep_fuzzing.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_miri.yml b/.github/workflows/dep_miri.yml
index 1deea5640d..7cab33f622 100644
--- a/.github/workflows/dep_miri.yml
+++ b/.github/workflows/dep_miri.yml
@@ -53,6 +53,8 @@ jobs:
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           cache: "false"
+          # Miri's generated sysroot manifest emits a Cargo warning.
+          build-warnings: warn
 
       - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29  # v2.87.21
         with:
diff --git a/.github/workflows/dep_run_examples.yml b/.github/workflows/dep_run_examples.yml
index 9265538387..27a08e40c5 100644
--- a/.github/workflows/dep_run_examples.yml
+++ b/.github/workflows/dep_run_examples.yml
@@ -62,7 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_update_guest_locks.yml b/.github/workflows/dep_update_guest_locks.yml
index 1c5ea876d1..3e0a4ad734 100644
--- a/.github/workflows/dep_update_guest_locks.yml
+++ b/.github/workflows/dep_update_guest_locks.yml
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: hyperlight-dev/ci-setup-workflow@82d1f2ba0fe8d5ee996ae7452d1e5cc60a484c44  # v2.0.0
+        uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/src/hyperlight_guest_bin/src/libc_stubs.rs b/src/hyperlight_guest_bin/src/libc_stubs.rs
index 47e54a3529..18756cf31c 100644
--- a/src/hyperlight_guest_bin/src/libc_stubs.rs
+++ b/src/hyperlight_guest_bin/src/libc_stubs.rs
@@ -1,6 +1,20 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2025 The Hyperlight Authors.
 
+// These are guest libc shims that must match the C ABI exactly. They are exported as
+// `extern "C"` symbols so the guest can link against libc entry points, but they are not
+// normal Rust APIs and the Rust safety qualifier is intentionally not part of the ABI.
+//
+// Newer rustc warns about functions of this shape with `suspicious_runtime_symbol_definitions`,
+// even though the warning is a false positive here. We suppress it because the ABI contract is
+// the important thing. We also allow `unknown_lints` so older guest toolchains can still build
+// even though they do not know this lint's name yet.
+#![allow(
+    unknown_lints,
+    suspicious_runtime_symbol_definitions,
+    reason = "These symbols are intentionally exported with the C ABI; safety qualifiers do not affect it, and older compilers do not know this lint."
+)]
+
 use alloc::string::String;
 use alloc::vec;
 use core::sync::atomic::{AtomicU64, Ordering};
diff --git a/src/hyperlight_libc/build.rs b/src/hyperlight_libc/build.rs
index 62aff1dd78..f2bf3708c7 100644
--- a/src/hyperlight_libc/build.rs
+++ b/src/hyperlight_libc/build.rs
@@ -31,10 +31,10 @@ fn copy_includes<P: AsRef<Path>, Q: AsRef<Path> + std::fmt::Debug>(
 
         if kind.is_dir() {
             fs::create_dir_all(&dst)
-                .with_context(|| format!("could not create include dir {:?}", &dst))?;
+                .with_context(|| format!("could not create include dir {:?}", dst))?;
             copy_includes(&dst, src)?;
         } else if Some(std::ffi::OsStr::new("h")) == src.extension() {
-            fs::copy(&src, &dst).with_context(|| format!("could not copy header {:?}", &src))?;
+            fs::copy(&src, &dst).with_context(|| format!("could not copy header {:?}", src))?;
         }
     }
 
@@ -213,6 +213,8 @@ fn generate_bindings(include_dir: &Path, out_dir: &Path) -> Result<()> {
         .header(include_dir.join("sys/time.h").to_string_lossy())
         .clang_arg(format!("-I{}", include_dir.display()))
         .clang_arg("-nostdlibinc")
+        // Preserve size_t in runtime function declarations for bindgen.
+        .clang_arg("-fno-builtin")
         .clang_arg(Target::get()?.clang_flag())
         .clang_arg("-fno-stack-protector")
         .clang_arg("-D_POSIX_MONOTONIC_CLOCK=1")
@@ -336,7 +338,7 @@ fn cargo_main() -> Result<()> {
         let binroot = PathBuf::from(binroot);
         let binpath = env::current_exe().expect("couldn't get build script path");
         fs::create_dir_all(&binroot)
-            .unwrap_or_else(|e| panic!("Could not create binary root {:?}: {}", &binroot, e));
+            .unwrap_or_else(|e| panic!("Could not create binary root {:?}: {}", binroot, e));
         fs::write(binroot.join(".out_dir"), out_dir).expect("Could not write out_dir");
         fs::copy(&binpath, binroot.join("clang")).expect("Could not copy to clang");
         fs::copy(&binpath, binroot.join("clang.exe")).expect("Could not copy to clang.exe");

From a84a2c5ab7ae9bd43ef2c5b8491a51ec85c83db8 Mon Sep 17 00:00:00 2001
From: Simon Davies <simongdavies@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:23:05 +0100
Subject: [PATCH 3/5] review fixes and move to common workflow v2.2.0

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
---
 .devcontainer/Dockerfile                      |  1 -
 .github/workflows/CargoPublish.yml            |  4 +-
 .github/workflows/Coverage.yml                |  3 +-
 .github/workflows/CreateRelease.yml           | 10 ++---
 .github/workflows/PrimeCaches.yml             |  4 +-
 .github/workflows/RegenSnapshotGoldens.yml    |  4 +-
 .github/workflows/RustNightly.yml             |  3 +-
 .github/workflows/ValidatePullRequest.yml     |  8 +---
 .github/workflows/copilot-setup-steps.yml     |  2 +-
 .github/workflows/dep_benchmarks.yml          |  2 +-
 .github/workflows/dep_build_guests.yml        |  3 +-
 .github/workflows/dep_build_test.yml          |  4 +-
 .github/workflows/dep_code_checks.yml         | 17 +++++++-
 .github/workflows/dep_fuzzing.yml             |  4 +-
 .github/workflows/dep_run_examples.yml        |  4 +-
 .github/workflows/dep_update_guest_locks.yml  |  2 +-
 CHANGELOG.md                                  |  4 ++
 CONTRIBUTING.md                               |  2 +-
 flake.nix                                     | 13 +++---
 src/hyperlight_guest_bin/src/libc_stubs.rs    | 41 +++++++++++--------
 .../tests/sandbox_host_tests.rs               |  8 ++++
 src/tests/c_guests/c_simpleguest/main.c       | 24 +++++++++++
 22 files changed, 100 insertions(+), 67 deletions(-)

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 10d2ab3c07..bdd98aec91 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -55,7 +55,6 @@ ARG GUEST_RUST_TOOLCHAIN=1.94.1
 # Install rust
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     && rustup default ${RUST_TOOLCHAIN} \
-    && rustup component add clippy rustfmt --toolchain ${RUST_TOOLCHAIN} \
     && rustup target add x86_64-unknown-linux-gnu x86_64-unknown-linux-musl --toolchain ${RUST_TOOLCHAIN} \
     && rustup toolchain install ${GUEST_RUST_TOOLCHAIN} --component clippy,rustfmt,rust-src --target x86_64-unknown-none \
     && rustup toolchain add nightly-2026-09-22-x86_64-unknown-linux-gnu \
diff --git a/.github/workflows/CargoPublish.yml b/.github/workflows/CargoPublish.yml
index 27939109a9..3804d21fdb 100644
--- a/.github/workflows/CargoPublish.yml
+++ b/.github/workflows/CargoPublish.yml
@@ -38,9 +38,7 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
 
       - name: Check crate versions
         shell: bash
diff --git a/.github/workflows/Coverage.yml b/.github/workflows/Coverage.yml
index e378089e71..511848d314 100644
--- a/.github/workflows/Coverage.yml
+++ b/.github/workflows/Coverage.yml
@@ -13,7 +13,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  CARGO_PROFILE_DEV_DEBUG: "2"
   RUST_BACKTRACE: full
 
 permissions:
@@ -39,7 +38,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/CreateRelease.yml b/.github/workflows/CreateRelease.yml
index e2c4f0af18..ef82bdc837 100644
--- a/.github/workflows/CreateRelease.yml
+++ b/.github/workflows/CreateRelease.yml
@@ -35,9 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -56,9 +54,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -134,7 +130,7 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/PrimeCaches.yml b/.github/workflows/PrimeCaches.yml
index 76439db399..971682b7a7 100644
--- a/.github/workflows/PrimeCaches.yml
+++ b/.github/workflows/PrimeCaches.yml
@@ -96,9 +96,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/RegenSnapshotGoldens.yml b/.github/workflows/RegenSnapshotGoldens.yml
index 77afd0ba75..f12a678786 100644
--- a/.github/workflows/RegenSnapshotGoldens.yml
+++ b/.github/workflows/RegenSnapshotGoldens.yml
@@ -171,9 +171,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/RustNightly.yml b/.github/workflows/RustNightly.yml
index 0d4adfa875..e28829e3aa 100644
--- a/.github/workflows/RustNightly.yml
+++ b/.github/workflows/RustNightly.yml
@@ -13,7 +13,6 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
-  CARGO_PROFILE_DEV_DEBUG: "2"
   RUST_BACKTRACE: full
 
 defaults:
@@ -45,7 +44,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/ValidatePullRequest.yml b/.github/workflows/ValidatePullRequest.yml
index d20af0276c..bdc8d5a514 100644
--- a/.github/workflows/ValidatePullRequest.yml
+++ b/.github/workflows/ValidatePullRequest.yml
@@ -111,9 +111,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -317,9 +315,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index b47dfcf0dc..ceb45f5c97 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_benchmarks.yml b/.github/workflows/dep_benchmarks.yml
index ba8cce2135..6bce68b584 100644
--- a/.github/workflows/dep_benchmarks.yml
+++ b/.github/workflows/dep_benchmarks.yml
@@ -75,7 +75,7 @@ jobs:
           # The baseline pass checks out another commit, which needs its history.
           fetch-depth: ${{ inputs.baseline_ref == '' && 1 || 0 }}
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_build_guests.yml b/.github/workflows/dep_build_guests.yml
index 6149058c2a..0c5c9262c5 100644
--- a/.github/workflows/dep_build_guests.yml
+++ b/.github/workflows/dep_build_guests.yml
@@ -33,7 +33,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  CARGO_PROFILE_DEV_DEBUG: "2"
 
 permissions:
   contents: read
@@ -85,7 +84,7 @@ jobs:
             echo "directory=" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: ${{ steps.guest-toolchain.outputs.directory }}
         env:
diff --git a/.github/workflows/dep_build_test.yml b/.github/workflows/dep_build_test.yml
index bd2cf4431d..641a3f5d55 100644
--- a/.github/workflows/dep_build_test.yml
+++ b/.github/workflows/dep_build_test.yml
@@ -84,9 +84,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_code_checks.yml b/.github/workflows/dep_code_checks.yml
index 53eb570457..05ac0a4223 100644
--- a/.github/workflows/dep_code_checks.yml
+++ b/.github/workflows/dep_code_checks.yml
@@ -35,7 +35,20 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - name: Check guest toolchains match
+        run: |
+          python3 - <<'PY'
+          import tomllib
+
+          def channel(path):
+              with open(path, "rb") as source:
+                  return tomllib.load(source)["toolchain"]["channel"]
+
+          if channel("src/tests/rust_guests/rust-toolchain.toml") != channel("src/hyperlight_guest_capi/rust-toolchain.toml"):
+              raise ValueError("Guest Rust toolchains must match")
+          PY
+
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
@@ -121,7 +134,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_fuzzing.yml b/.github/workflows/dep_fuzzing.yml
index d3633ea682..b7ecc836cb 100644
--- a/.github/workflows/dep_fuzzing.yml
+++ b/.github/workflows/dep_fuzzing.yml
@@ -51,9 +51,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_run_examples.yml b/.github/workflows/dep_run_examples.yml
index 27a08e40c5..a450ab5a12 100644
--- a/.github/workflows/dep_run_examples.yml
+++ b/.github/workflows/dep_run_examples.yml
@@ -62,9 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
-        with:
-          additional-toolchain-directory: src/tests/rust_guests
+      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_update_guest_locks.yml b/.github/workflows/dep_update_guest_locks.yml
index 3e0a4ad734..90778dcaed 100644
--- a/.github/workflows/dep_update_guest_locks.yml
+++ b/.github/workflows/dep_update_guest_locks.yml
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: hyperlight-dev/ci-setup-workflow@4b7107a0f24c523f503c861ddeb8180d3a23e7f7  # v2.1.0
+        uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9eac2ff638..d4a5b9cbe1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,10 +8,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+* **Breaking:** Generated libc bindings use `usize` for `size_t` arguments and return values, including `strlen` and `memcpy`. Rust callers that use `u64` or `c_ulong` need explicit conversions. The C ABI is unchanged.
+
 ### Removed
 
 ### Fixed
 
+* Guest libc accepts null buffers for zero-length writes.
+
 ## [v0.18.0] - 2026-10-13
 
 ### Added
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b340c64d12..cfd4b34914 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -123,7 +123,7 @@ If you are using the [Rust Analyzer](https://rust-analyzer.github.io/manual.html
 
 The root `rust-toolchain.toml` pins the rust version for host builds and tools.
 
-Rust guests and the C API use Rust 1.94.1, pinned in
+Rust guests and the C API use the toolchains pinned in
 `src/tests/rust_guests/rust-toolchain.toml` and
 `src/hyperlight_guest_capi/rust-toolchain.toml`. These files should be kept in sync.
 
diff --git a/flake.nix b/flake.nix
index 693e42e33c..8d1fe33daa 100644
--- a/flake.nix
+++ b/flake.nix
@@ -90,7 +90,7 @@
           # Hyperlight needs a variety of toolchains, since we use Nightly
           # for rustfmt and old toolchains to verify MSRV
           toolchains = lib.mapAttrs (_: customisedRustChannelOf) {
-            stable = {
+            "1.99.1" = {
               date = "2026-10-15";
               channel = "stable";
               sha256 = "fb152be80975c194aa5fc684b2aec3a6e14e2b855efe2faa4e5f8ae6e590f463";
@@ -112,9 +112,11 @@
             };
           };
 
+          host-toolchain = toolchains.${(builtins.fromTOML (builtins.readFile ./rust-toolchain.toml)).toolchain.channel};
+
           rust-platform = makeRustPlatform {
-            cargo = toolchains.stable.rust;
-            rustc = toolchains.stable.rust;
+            cargo = host-toolchain.rust;
+            rustc = host-toolchain.rust;
           };
 
           manifests = {
@@ -212,7 +214,7 @@
               clauses = lib.strings.concatStringsSep "\n"
                 (lib.mapAttrsToList clause toolchains);
             in ''
-              base="${toolchains.stable.rust}"
+              base="${host-toolchain.rust}"
               requested="''${RUSTUP_TOOLCHAIN:-}"
               if [[ "$1" == +* ]]; then
                 requested="''${1#+}"
@@ -229,8 +231,7 @@
               fi
               case "+$requested" in
                 ${clauses}
-                +1.99.1) base="${toolchains.stable.rust}"; ;;
-                +) requested=stable; ;;
+                +stable | +stable-${host-toolchain.rust.toolchainVersionAttrs.date} | +) requested=stable; ;;
                 *) echo "Unsupported Rust toolchain: $requested" >&2; exit 1; ;;
               esac
               if [[ "$1" == install ]]; then exit 0; fi
diff --git a/src/hyperlight_guest_bin/src/libc_stubs.rs b/src/hyperlight_guest_bin/src/libc_stubs.rs
index 18756cf31c..52537fde85 100644
--- a/src/hyperlight_guest_bin/src/libc_stubs.rs
+++ b/src/hyperlight_guest_bin/src/libc_stubs.rs
@@ -1,20 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2025 The Hyperlight Authors.
 
-// These are guest libc shims that must match the C ABI exactly. They are exported as
-// `extern "C"` symbols so the guest can link against libc entry points, but they are not
-// normal Rust APIs and the Rust safety qualifier is intentionally not part of the ABI.
-//
-// Newer rustc warns about functions of this shape with `suspicious_runtime_symbol_definitions`,
-// even though the warning is a false positive here. We suppress it because the ABI contract is
-// the important thing. We also allow `unknown_lints` so older guest toolchains can still build
-// even though they do not know this lint's name yet.
-#![allow(
-    unknown_lints,
-    suspicious_runtime_symbol_definitions,
-    reason = "These symbols are intentionally exported with the C ABI; safety qualifiers do not affect it, and older compilers do not know this lint."
-)]
-
 use alloc::string::String;
 use alloc::vec;
 use core::sync::atomic::{AtomicU64, Ordering};
@@ -43,6 +29,11 @@ fn current_time() -> (u64, u64) {
 }
 
 #[unsafe(no_mangle)]
+#[allow(
+    unknown_lints,
+    suspicious_runtime_symbol_definitions,
+    reason = "This stub never accesses buf. Older compilers lack this lint."
+)]
 extern "C" fn read(fd: c_int, buf: *mut c_void, count: usize) -> isize {
     if buf.is_null() && count > 0 {
         set_errno(EINVAL);
@@ -57,8 +48,11 @@ extern "C" fn read(fd: c_int, buf: *mut c_void, count: usize) -> isize {
     0
 }
 
+/// # Safety
+/// For nonzero `count`, `buf` must point to `count` initialized bytes in one allocation.
+/// The bytes must remain readable and unchanged during this call, and `count` must fit in `isize`.
 #[unsafe(no_mangle)]
-extern "C" fn write(fd: c_int, buf: *const c_void, count: usize) -> isize {
+unsafe extern "C" fn write(fd: c_int, buf: *const c_void, count: usize) -> isize {
     if buf.is_null() && count > 0 {
         set_errno(EINVAL);
         return -1;
@@ -69,7 +63,12 @@ extern "C" fn write(fd: c_int, buf: *const c_void, count: usize) -> isize {
         return -1;
     }
 
-    let slice = unsafe { core::slice::from_raw_parts(buf as *const u8, count) };
+    let slice = if count == 0 {
+        &[]
+    } else {
+        // SAFETY: The caller guarantees a readable slice for nonzero count.
+        unsafe { core::slice::from_raw_parts(buf as *const u8, count) }
+    };
     let s = String::from_utf8_lossy(slice);
     match call_host_function::<i32>(
         "HostPrint",
@@ -84,8 +83,10 @@ extern "C" fn write(fd: c_int, buf: *const c_void, count: usize) -> isize {
     }
 }
 
+/// # Safety
+/// A non-null `tp` must be aligned and valid for exclusive writes to one `timespec`.
 #[unsafe(no_mangle)]
-extern "C" fn clock_gettime(clk_id: clockid_t, tp: *mut timespec) -> c_int {
+unsafe extern "C" fn clock_gettime(clk_id: clockid_t, tp: *mut timespec) -> c_int {
     // The libc bindings generated by bindgen are u32, but we expect them to be clockid_t,
     // so we convert the constants to the expected type here for comparison.
     const CLOCK_ID_REALTIME: clockid_t = CLOCK_REALTIME as _;
@@ -99,6 +100,7 @@ extern "C" fn clock_gettime(clk_id: clockid_t, tp: *mut timespec) -> c_int {
     match clk_id {
         CLOCK_ID_REALTIME | CLOCK_ID_MONOTONIC => {
             let (secs, nanos) = current_time();
+            // SAFETY: tp is non-null and the caller guarantees writable timespec storage.
             unsafe {
                 (*tp).tv_sec = secs as c_long;
                 (*tp).tv_nsec = nanos as c_long;
@@ -124,6 +126,11 @@ extern "C" fn lseek(_fd: c_int, _offset: c_long, _whence: c_int) -> c_long {
 }
 
 #[unsafe(no_mangle)]
+#[allow(
+    unknown_lints,
+    suspicious_runtime_symbol_definitions,
+    reason = "This stub has no safety preconditions. Older compilers lack this lint."
+)]
 extern "C" fn close(_fd: c_int) -> c_int {
     0
 }
diff --git a/src/hyperlight_host/tests/sandbox_host_tests.rs b/src/hyperlight_host/tests/sandbox_host_tests.rs
index 241e196f2c..1064b11522 100644
--- a/src/hyperlight_host/tests/sandbox_host_tests.rs
+++ b/src/hyperlight_host/tests/sandbox_host_tests.rs
@@ -16,6 +16,14 @@ use crate::common::{
     with_rust_uninit_sandbox, with_rust_uninit_sandbox_cfg,
 };
 
+#[test]
+fn libc_stubs_handle_empty_writes_and_clock_outputs() {
+    with_c_sandbox(|mut sandbox| {
+        let result: i32 = sandbox.call("CheckLibcStubs", ()).unwrap();
+        assert_eq!(result, 0);
+    });
+}
+
 #[test]
 fn pass_byte_array() {
     with_all_sandboxes(|mut sandbox| {
diff --git a/src/tests/c_guests/c_simpleguest/main.c b/src/tests/c_guests/c_simpleguest/main.c
index 5cf74e6e3b..d8e5a04b3f 100644
--- a/src/tests/c_guests/c_simpleguest/main.c
+++ b/src/tests/c_guests/c_simpleguest/main.c
@@ -1,3 +1,5 @@
+#define _POSIX_MONOTONIC_CLOCK 1
+
 // Included from hyperlight_guest_capi/include
 #include "hyperlight_guest.h"
 // Included from hyperlight_libc/third_party/picolibc
@@ -6,6 +8,9 @@
 #include "stdlib.h"
 #include "assert.h"
 #include "stdio.h"
+#include "errno.h"
+#include "time.h"
+#include "unistd.h"
 
 #define GUEST_SCRATCH_SIZE (0x40000) // default scratch size
 #define MAX_BUFFER_SIZE (1024)
@@ -43,6 +48,23 @@ int print_output(const char *message) {
   return res;
 }
 
+int check_libc_stubs(void) {
+  assert(write(1, NULL, 0) == 0);
+  assert(write(2, NULL, 0) == 0);
+  assert(write(1, NULL, 1) == -1 && errno == EINVAL);
+  assert(write(-1, "", 0) == -1 && errno == EBADF);
+
+  struct timespec before, after;
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
+  assert(clock_gettime(CLOCK_MONOTONIC, &after) == 0);
+  assert(after.tv_sec == before.tv_sec + 1);
+  assert(before.tv_nsec == 0 && after.tv_nsec == 0);
+  assert(clock_gettime(CLOCK_REALTIME, &after) == 0);
+  assert(clock_gettime(CLOCK_MONOTONIC, NULL) == -1 && errno == EINVAL);
+  assert(clock_gettime(-1, &after) == -1 && errno == EINVAL);
+  return 0;
+}
+
 __attribute__((optnone)) 
 int stack_allocate(int32_t length) {
   void *buffer = alloca(length);
@@ -458,6 +480,7 @@ HYPERLIGHT_WRAP_FUNCTION(echo, String, 1, String)
 // HYPERLIGHT_WRAP_FUNCTION(set_byte_array_to_zero, 1, VecBytes) is not valid for functions that return VecBytes
 HYPERLIGHT_WRAP_FUNCTION(guest_function, Int, 1, String)
 HYPERLIGHT_WRAP_FUNCTION(print_output, Int, 1, String)
+HYPERLIGHT_WRAP_FUNCTION(check_libc_stubs, Int, 0)
 HYPERLIGHT_WRAP_FUNCTION(stack_allocate, Int, 1, Int)
 HYPERLIGHT_WRAP_FUNCTION(stack_overflow, Int, 1, Int)
 HYPERLIGHT_WRAP_FUNCTION(buffer_overrun, Int, 1, String)
@@ -500,6 +523,7 @@ void hyperlight_main(void)
     hl_register_function_definition("SetByteArrayToZero", set_byte_array_to_zero, 1, (hl_ParameterType[]){hl_ParameterType_VecBytes}, hl_ReturnType_VecBytes);
     HYPERLIGHT_REGISTER_FUNCTION("GuestMethod1", guest_function);
     HYPERLIGHT_REGISTER_FUNCTION("PrintOutput", print_output);
+    HYPERLIGHT_REGISTER_FUNCTION("CheckLibcStubs", check_libc_stubs);
     HYPERLIGHT_REGISTER_FUNCTION("StackAllocate", stack_allocate);
     HYPERLIGHT_REGISTER_FUNCTION("StackOverflow", stack_overflow);
     HYPERLIGHT_REGISTER_FUNCTION("BufferOverrun", buffer_overrun);

From 2974d451f204a437ff76216ea021ffea020ee044 Mon Sep 17 00:00:00 2001
From: Simon Davies <simongdavies@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:26:03 +0100
Subject: [PATCH 4/5] update to v2.3.0 of the common workflow

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
---
 .github/workflows/CargoPublish.yml           | 2 +-
 .github/workflows/Coverage.yml               | 2 +-
 .github/workflows/CreateRelease.yml          | 6 +++---
 .github/workflows/PrimeCaches.yml            | 2 +-
 .github/workflows/RegenSnapshotGoldens.yml   | 2 +-
 .github/workflows/RustNightly.yml            | 2 +-
 .github/workflows/ValidatePullRequest.yml    | 4 ++--
 .github/workflows/copilot-setup-steps.yml    | 2 +-
 .github/workflows/dep_benchmarks.yml         | 2 +-
 .github/workflows/dep_build_guests.yml       | 2 +-
 .github/workflows/dep_build_test.yml         | 2 +-
 .github/workflows/dep_code_checks.yml        | 4 ++--
 .github/workflows/dep_fuzzing.yml            | 2 +-
 .github/workflows/dep_run_examples.yml       | 2 +-
 .github/workflows/dep_update_guest_locks.yml | 2 +-
 15 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/CargoPublish.yml b/.github/workflows/CargoPublish.yml
index 3804d21fdb..d43900eb6a 100644
--- a/.github/workflows/CargoPublish.yml
+++ b/.github/workflows/CargoPublish.yml
@@ -38,7 +38,7 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
 
       - name: Check crate versions
         shell: bash
diff --git a/.github/workflows/Coverage.yml b/.github/workflows/Coverage.yml
index 511848d314..1b8965a86e 100644
--- a/.github/workflows/Coverage.yml
+++ b/.github/workflows/Coverage.yml
@@ -38,7 +38,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/CreateRelease.yml b/.github/workflows/CreateRelease.yml
index ef82bdc837..95c64dcba2 100644
--- a/.github/workflows/CreateRelease.yml
+++ b/.github/workflows/CreateRelease.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -54,7 +54,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -130,7 +130,7 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/PrimeCaches.yml b/.github/workflows/PrimeCaches.yml
index 971682b7a7..75ac7ee1bb 100644
--- a/.github/workflows/PrimeCaches.yml
+++ b/.github/workflows/PrimeCaches.yml
@@ -96,7 +96,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/RegenSnapshotGoldens.yml b/.github/workflows/RegenSnapshotGoldens.yml
index f12a678786..321aa419e8 100644
--- a/.github/workflows/RegenSnapshotGoldens.yml
+++ b/.github/workflows/RegenSnapshotGoldens.yml
@@ -171,7 +171,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/RustNightly.yml b/.github/workflows/RustNightly.yml
index e28829e3aa..a2c62ee6da 100644
--- a/.github/workflows/RustNightly.yml
+++ b/.github/workflows/RustNightly.yml
@@ -44,7 +44,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/ValidatePullRequest.yml b/.github/workflows/ValidatePullRequest.yml
index bdc8d5a514..b843ecd3da 100644
--- a/.github/workflows/ValidatePullRequest.yml
+++ b/.github/workflows/ValidatePullRequest.yml
@@ -111,7 +111,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -315,7 +315,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index ceb45f5c97..bc52641839 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_benchmarks.yml b/.github/workflows/dep_benchmarks.yml
index 6bce68b584..ba3e04a91f 100644
--- a/.github/workflows/dep_benchmarks.yml
+++ b/.github/workflows/dep_benchmarks.yml
@@ -75,7 +75,7 @@ jobs:
           # The baseline pass checks out another commit, which needs its history.
           fetch-depth: ${{ inputs.baseline_ref == '' && 1 || 0 }}
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_build_guests.yml b/.github/workflows/dep_build_guests.yml
index 0c5c9262c5..264e68d450 100644
--- a/.github/workflows/dep_build_guests.yml
+++ b/.github/workflows/dep_build_guests.yml
@@ -84,7 +84,7 @@ jobs:
             echo "directory=" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: ${{ steps.guest-toolchain.outputs.directory }}
         env:
diff --git a/.github/workflows/dep_build_test.yml b/.github/workflows/dep_build_test.yml
index 641a3f5d55..480bf27f0b 100644
--- a/.github/workflows/dep_build_test.yml
+++ b/.github/workflows/dep_build_test.yml
@@ -84,7 +84,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_code_checks.yml b/.github/workflows/dep_code_checks.yml
index 05ac0a4223..48c744e92c 100644
--- a/.github/workflows/dep_code_checks.yml
+++ b/.github/workflows/dep_code_checks.yml
@@ -48,7 +48,7 @@ jobs:
               raise ValueError("Guest Rust toolchains must match")
           PY
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
@@ -134,7 +134,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
diff --git a/.github/workflows/dep_fuzzing.yml b/.github/workflows/dep_fuzzing.yml
index b7ecc836cb..d541fb105b 100644
--- a/.github/workflows/dep_fuzzing.yml
+++ b/.github/workflows/dep_fuzzing.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_run_examples.yml b/.github/workflows/dep_run_examples.yml
index a450ab5a12..87efacf178 100644
--- a/.github/workflows/dep_run_examples.yml
+++ b/.github/workflows/dep_run_examples.yml
@@ -62,7 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dep_update_guest_locks.yml b/.github/workflows/dep_update_guest_locks.yml
index 90778dcaed..1a3f3a8d85 100644
--- a/.github/workflows/dep_update_guest_locks.yml
+++ b/.github/workflows/dep_update_guest_locks.yml
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: hyperlight-dev/ci-setup-workflow@2bf5e01a09c1c75f81913a435212cdf88399d3e0  # v2.2.0
+        uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:

From 792162019898c8204279b30efeaa3bbd64b1c124 Mon Sep 17 00:00:00 2001
From: Simon Davies <simongdavies@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:46:42 +0100
Subject: [PATCH 5/5] fix guest toolchain check

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
---
 .github/workflows/dep_code_checks.yml | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/dep_code_checks.yml b/.github/workflows/dep_code_checks.yml
index 48c744e92c..b22945f77a 100644
--- a/.github/workflows/dep_code_checks.yml
+++ b/.github/workflows/dep_code_checks.yml
@@ -35,25 +35,21 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Check guest toolchains match
-        run: |
-          python3 - <<'PY'
-          import tomllib
-
-          def channel(path):
-              with open(path, "rb") as source:
-                  return tomllib.load(source)["toolchain"]["channel"]
-
-          if channel("src/tests/rust_guests/rust-toolchain.toml") != channel("src/hyperlight_guest_capi/rust-toolchain.toml"):
-              raise ValueError("Guest Rust toolchains must match")
-          PY
-
       - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
           additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Check guest toolchains match
+        run: |
+          guest=$(cd src/tests/rust_guests && rustup show active-toolchain)
+          capi=$(cd src/hyperlight_guest_capi && rustup show active-toolchain)
+          if [[ "${guest%% *}" != "${capi%% *}" ]]; then
+            echo "::error::Guest Rust toolchains must match"
+            exit 1
+          fi
+
       # cargo-hyperlight builds a custom sysroot for x86_64-hyperlight-none target.
       # rust-cache cleans "anything not a dependency" from target dirs, removing the sysroot.
       # We cache sysroot separately to avoid rebuilding it (~10s) on every run.