Merge branch 'pin-rust-version-and-allow-automatic-install-of-right-des-554'

33 files changed, 43 insertions, 147 deletions

diff --git a/.github/workflows/android-audit.yml b/.github/workflows/android-audit.yml
index e949d62de9..68884ae526 100644
--- a/.github/workflows/android-audit.yml
+++ b/.github/workflows/android-audit.yml
@@ -37,8 +37,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
diff --git a/.github/workflows/android-kotlin-format-check.yml b/.github/workflows/android-kotlin-format-check.yml
index 31bfc9af3c..9960339098 100644
--- a/.github/workflows/android-kotlin-format-check.yml
+++ b/.github/workflows/android-kotlin-format-check.yml
@@ -27,8 +27,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
diff --git a/.github/workflows/cargo-vendor.yml b/.github/workflows/cargo-vendor.yml
index 14d2da7790..31177c725d 100644
--- a/.github/workflows/cargo-vendor.yml
+++ b/.github/workflows/cargo-vendor.yml
@@ -23,11 +23,5 @@ jobs:
         with:
           submodules: true
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Vendor Rust dependencies
         run: cargo vendor
diff --git a/.github/workflows/clippy.yml b/.github/workflows/clippy.yml
index ec1ccb030e..218eeeef23 100644
--- a/.github/workflows/clippy.yml
+++ b/.github/workflows/clippy.yml
@@ -25,8 +25,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image_android=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image_android=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image_android: ${{ env.inner_container_image_android }}
@@ -51,12 +50,6 @@ jobs:
           git submodule update --init --depth=1 dist-assets/binaries
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Install build dependencies
         if: matrix.os == 'ubuntu-latest'
         run: |
diff --git a/.github/workflows/daemon.yml b/.github/workflows/daemon.yml
index f37b6c6d54..8e22397b9c 100644
--- a/.github/workflows/daemon.yml
+++ b/.github/workflows/daemon.yml
@@ -49,8 +49,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
@@ -79,9 +78,15 @@ jobs:
           git config --global --add safe.directory '*'
           git submodule update --init --depth=1 dist-assets/binaries
           git submodule update --init --recursive --depth=1 wireguard-go-rs
-      # The container image already has rustup and Rust, but only the stable toolchain
+
+      # The container image already has rustup and the pinned version of Rust
       - name: Install Rust toolchain
-        run: rustup default ${{ matrix.rust }}
+        # When running this job for "stable" test against our pinned rust version
+        # instead of the stable channel.
+        # TODO: Improve this so both "stable" and the pinned version are tested if
+        # they differ.
+        if: ${{ matrix.rust != 'stable' }}
+        run: rustup override set ${{ matrix.rust }}
 
       - name: Build and test crates
         run: ./ci/check-rust.sh
@@ -102,12 +107,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Install Go
         uses: actions/setup-go@v3
         with:
@@ -168,17 +167,10 @@ jobs:
       # TODO: Remove once fixed
       - name: Install Rust x64 target
         if: ${{ matrix.config.arch == 'arm64' }}
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: x86_64-pc-windows-msvc
+        run: rustup target add x86_64-pc-windows-msvc
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: i686-pc-windows-msvc
-          default: true
+        run: rustup target add i686-pc-windows-msvc
 
       - name: Install msbuild
         uses: microsoft/setup-msbuild@v1.0.2
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index a23cdbd602..2a334ab52d 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -195,11 +195,7 @@ jobs:
           cache: 'npm'
           cache-dependency-path: desktop/package-lock.json
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: i686-pc-windows-msvc
-          default: true
+        run: rustup target add i686-pc-windows-msvc
       - name: Install latest zig
         uses: mlugg/setup-zig@v1
       - name: Install msbuild
@@ -287,11 +283,6 @@ jobs:
           node-version-file: desktop/package.json
           cache: 'npm'
           cache-dependency-path: desktop/package-lock.json
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
       - name: Build app
         run: ./build.sh
       - name: Build test executable
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index 8b80e3b5e0..a65f3523f9 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -24,13 +24,6 @@ jobs:
       - name: Checkout wireguard-go submodule
         run: git submodule update --init --depth=1 wireguard-go-rs
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-          profile: minimal
-
       - name: Setup node
         uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/ios-build-xcode-16.yml b/.github/workflows/ios-build-xcode-16.yml
index e871046310..cc8f6ac205 100644
--- a/.github/workflows/ios-build-xcode-16.yml
+++ b/.github/workflows/ios-build-xcode-16.yml
@@ -46,10 +46,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim
+        run: rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios-end-to-end-tests.yml b/.github/workflows/ios-end-to-end-tests.yml
index f177c28bf0..bbc70d8588 100644
--- a/.github/workflows/ios-end-to-end-tests.yml
+++ b/.github/workflows/ios-end-to-end-tests.yml
@@ -99,11 +99,7 @@ jobs:
           ref: ${{ env.COMMIT_HASH }}
 
       - name: Configure Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          override: true
-          target: aarch64-apple-ios
+        run: rustup target add aarch64-apple-ios
 
       - name: Build iOS end to end tests action
         uses: ./.github/actions/build-ios-e2e-tests
diff --git a/.github/workflows/ios-rust-ffi.yml b/.github/workflows/ios-rust-ffi.yml
index 07c52412a6..6d1457d4f1 100644
--- a/.github/workflows/ios-rust-ffi.yml
+++ b/.github/workflows/ios-rust-ffi.yml
@@ -26,11 +26,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: ${{ matrix.target }}
-          default: true
+        run: rustup target add ${{ matrix.target }}
 
       - name: Build and test crates
         shell: bash
@@ -58,11 +54,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: ${{ matrix.target }}
-          default: true
+        run: rustup target add ${{ matrix.target }}
 
       - name: Clippy check
         shell: bash
diff --git a/.github/workflows/ios-screenshots-creation.yml b/.github/workflows/ios-screenshots-creation.yml
index 64c64ac270..e842b08c1f 100644
--- a/.github/workflows/ios-screenshots-creation.yml
+++ b/.github/workflows/ios-screenshots-creation.yml
@@ -33,10 +33,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim x86_64-apple-ios
+        run: rustup target add aarch64-apple-ios-sim x86_64-apple-ios
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios-screenshots-tests.yml b/.github/workflows/ios-screenshots-tests.yml
index bef9a9ab02..93084a8b14 100644
--- a/.github/workflows/ios-screenshots-tests.yml
+++ b/.github/workflows/ios-screenshots-tests.yml
@@ -45,10 +45,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim
+        run: rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios-validate-build-schemas.yml b/.github/workflows/ios-validate-build-schemas.yml
index 8b40e71b4e..fc0f6a7b86 100644
--- a/.github/workflows/ios-validate-build-schemas.yml
+++ b/.github/workflows/ios-validate-build-schemas.yml
@@ -46,10 +46,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim x86_64-apple-ios
+        run: rustup target add aarch64-apple-ios-sim x86_64-apple-ios
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 70b094cebb..2565e91f01 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -91,8 +91,6 @@ jobs:
         run: |
           brew bundle dump
           brew bundle
-          rustup default stable
-          rustup update stable
           rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
diff --git a/.github/workflows/rust-unused-dependencies.yml b/.github/workflows/rust-unused-dependencies.yml
index eba2735f9c..aed6d4ea22 100644
--- a/.github/workflows/rust-unused-dependencies.yml
+++ b/.github/workflows/rust-unused-dependencies.yml
@@ -51,7 +51,7 @@ jobs:
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
       - name: Install nightly Rust toolchain
-        run: rustup default $RUST_NIGHTLY_TOOLCHAIN
+        run: rustup override set $RUST_NIGHTLY_TOOLCHAIN
 
       - uses: taiki-e/install-action@v2
         with:
@@ -81,9 +81,9 @@ jobs:
           git config --global --add safe.directory '*'
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
-      - name: Install nightly Rust toolchain
+      - name: Install nightly Rust
         run: |
-          rustup default $RUST_NIGHTLY_TOOLCHAIN
+          rustup override set ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
           rustup target add aarch64-linux-android
 
       - uses: taiki-e/install-action@v2
@@ -123,12 +123,8 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
-          default: true
-          profile: minimal
+      - name: Install nightly Rust
+        run: rustup override set ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
 
       - uses: taiki-e/install-action@v2
         with:
diff --git a/.github/workflows/rustfmt.yml b/.github/workflows/rustfmt.yml
index 85f88a667a..54c39aaf3e 100644
--- a/.github/workflows/rustfmt.yml
+++ b/.github/workflows/rustfmt.yml
@@ -20,13 +20,6 @@ jobs:
       - name: Checkout wireguard-go submodule
         run: git submodule update --init --depth=1 wireguard-go-rs
 
-      - name: Install nightly Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: rustfmt
-          default: true
-
       - name: Check formatting
         run: |-
           rustfmt --version
diff --git a/.github/workflows/testframework-clippy.yml b/.github/workflows/testframework-clippy.yml
index 3ebd0fa274..9a5040d882 100644
--- a/.github/workflows/testframework-clippy.yml
+++ b/.github/workflows/testframework-clippy.yml
@@ -28,12 +28,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Install build dependencies
         if: matrix.os == 'ubuntu-latest'
         run: |
@@ -61,12 +55,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Clippy check
         working-directory: test
         shell: bash
diff --git a/.github/workflows/testframework-rustfmt.yml b/.github/workflows/testframework-rustfmt.yml
index 27996c6e2b..a21d86f694 100644
--- a/.github/workflows/testframework-rustfmt.yml
+++ b/.github/workflows/testframework-rustfmt.yml
@@ -18,13 +18,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: rustfmt
-          default: true
-
       - name: Check formatting
         working-directory: test
         run: |-
diff --git a/.github/workflows/testframework.yml b/.github/workflows/testframework.yml
index 6f6b874811..630152cb02 100644
--- a/.github/workflows/testframework.yml
+++ b/.github/workflows/testframework.yml
@@ -42,8 +42,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
@@ -83,12 +82,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Build test runner
         working-directory: test
         run: cargo build --locked
diff --git a/.github/workflows/translations-converter.yml b/.github/workflows/translations-converter.yml
index fc24845cc7..abc674d31f 100644
--- a/.github/workflows/translations-converter.yml
+++ b/.github/workflows/translations-converter.yml
@@ -16,12 +16,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Build and test translations converter tool
         working-directory: android/translations-converter
         run: cargo test
diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml
index 7e0c7e7d46..ee5eafb27a 100644
--- a/.github/workflows/translations.yml
+++ b/.github/workflows/translations.yml
@@ -32,12 +32,6 @@ jobs:
         shell: bash
         run: npm ci
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Verify translations
         shell: bash
         run: scripts/localization verify
diff --git a/.github/workflows/verify-locked-down-signatures.yml b/.github/workflows/verify-locked-down-signatures.yml
index eee84bf2a7..9453cb789d 100644
--- a/.github/workflows/verify-locked-down-signatures.yml
+++ b/.github/workflows/verify-locked-down-signatures.yml
@@ -11,6 +11,7 @@ on:
       - test/Cargo.lock
       - deny.toml
       - test/deny.toml
+      - rust-toolchain.toml
       - desktop/package-lock.json
       - wireguard-go-rs/libwg/go.sum
       - ci/keys/**
diff --git a/Cargo.toml b/Cargo.toml
index 836f819e9a..cf9ca31acf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,6 +3,7 @@ authors = ["Mullvad VPN"]
 repository = "https://github.com/mullvad/mullvadvpn-app/"
 license = "GPL-3.0"
 edition = "2021"
+# Must be less than or equal to `channel` in `rust-toolchain.toml`
 rust-version = "1.80.0"
 
 [workspace]
diff --git a/android/docker/Dockerfile b/android/docker/Dockerfile
index 32175853a6..3635fc55c0 100644
--- a/android/docker/Dockerfile
+++ b/android/docker/Dockerfile
@@ -19,7 +19,7 @@
 # patch for a given go version can be identified by checking the wireguard-android
 # repo: https://git.zx2c4.com/wireguard-android/tree/tunnel/tools/libwg-go.
 # It's also important to keep the go path in sync.
-FROM ghcr.io/mullvad/mullvadvpn-app-build:124ce3fef
+FROM ghcr.io/mullvad/mullvadvpn-app-build:85fa990a4
 
 # === Metadata ===
 LABEL org.opencontainers.image.source=https://github.com/mullvad/mullvadvpn-app
diff --git a/building/Dockerfile b/building/Dockerfile
index 07018b6cd9..31208fa3b6 100644
--- a/building/Dockerfile
+++ b/building/Dockerfile
@@ -54,11 +54,13 @@ RUN dpkg --add-architecture arm64 && apt-get update -y && apt-get install -y \
 
 # === Rust ===
 
-# Install latest stable Rust toolchain for both x86_64-unknown-linux-gnu and aarch64-unknown-linux-gnu,
+ARG RUST_VERSION=stable
+
+# Install the Rust toolchain for both x86_64-unknown-linux-gnu and aarch64-unknown-linux-gnu,
 # plus x86_64-pc-windows-gnu for Windows cross-compilation/linting
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y \
-    --default-toolchain stable \
+    --default-toolchain $RUST_VERSION \
     --profile minimal \
     --component clippy \
     --target aarch64-unknown-linux-gnu \
diff --git a/building/android-container-image.txt b/building/android-container-image.txt
index 2f448285ef..4a7ebf33b0 100644
--- a/building/android-container-image.txt
+++ b/building/android-container-image.txt
@@ -1 +1 @@
-ghcr.io/mullvad/mullvadvpn-app-build-android:3ac5745b0
+ghcr.io/mullvad/mullvadvpn-app-build-android:754c2d39f
diff --git a/building/build-and-publish-container-image.sh b/building/build-and-publish-container-image.sh
index 4ed02af816..8fd78b6365 100755
--- a/building/build-and-publish-container-image.sh
+++ b/building/build-and-publish-container-image.sh
@@ -35,8 +35,11 @@ case ${1-:""} in
 esac
 full_container_name="$REGISTRY_HOST/$REGISTRY_ORG/$container_name"
 
+RUST_VERSION=$(rg -o "channel = \"(.*)\"" -r '$1' "$REPO_DIR/rust-toolchain.toml")
+
 log_header "Building $full_container_name tagged as '$tag' and 'latest'"
 podman build -f "$containerfile_path" "$container_context_dir" --no-cache \
+    --build-arg="RUST_VERSION=$RUST_VERSION" \
     -t "$full_container_name:$tag" \
     -t "$full_container_name:latest"
 
diff --git a/building/linux-container-image.txt b/building/linux-container-image.txt
index d0c298b4e9..d51dc5b95a 100644
--- a/building/linux-container-image.txt
+++ b/building/linux-container-image.txt
@@ -1 +1 @@
-ghcr.io/mullvad/mullvadvpn-app-build:124ce3fef
+ghcr.io/mullvad/mullvadvpn-app-build:85fa990a4
diff --git a/building/sigstore/mullvad/mullvadvpn-app-build-android@sha256=e1d4044e43a27fbcb4d18462db84ac5663bbbd3d6594acbdfcb4763dd18aeb7e/signature-1 b/building/sigstore/mullvad/mullvadvpn-app-build-android@sha256=e1d4044e43a27fbcb4d18462db84ac5663bbbd3d6594acbdfcb4763dd18aeb7e/signature-1
new file mode 100644
index 0000000000..6938d94499
--- /dev/null
+++ b/building/sigstore/mullvad/mullvadvpn-app-build-android@sha256=e1d4044e43a27fbcb4d18462db84ac5663bbbd3d6594acbdfcb4763dd18aeb7e/signature-1
diff --git a/building/sigstore/mullvad/mullvadvpn-app-build-android@sha256=e1d4044e43a27fbcb4d18462db84ac5663bbbd3d6594acbdfcb4763dd18aeb7e/signature-2 b/building/sigstore/mullvad/mullvadvpn-app-build-android@sha256=e1d4044e43a27fbcb4d18462db84ac5663bbbd3d6594acbdfcb4763dd18aeb7e/signature-2
new file mode 100644
index 0000000000..703d343364
--- /dev/null
+++ b/building/sigstore/mullvad/mullvadvpn-app-build-android@sha256=e1d4044e43a27fbcb4d18462db84ac5663bbbd3d6594acbdfcb4763dd18aeb7e/signature-2
diff --git a/building/sigstore/mullvad/mullvadvpn-app-build@sha256=6239e860bc35c0eb73321df227e363fcc822eab1da4993c4a21da92a30cdbb7e/signature-1 b/building/sigstore/mullvad/mullvadvpn-app-build@sha256=6239e860bc35c0eb73321df227e363fcc822eab1da4993c4a21da92a30cdbb7e/signature-1
new file mode 100644
index 0000000000..7f0086c76a
--- /dev/null
+++ b/building/sigstore/mullvad/mullvadvpn-app-build@sha256=6239e860bc35c0eb73321df227e363fcc822eab1da4993c4a21da92a30cdbb7e/signature-1
diff --git a/building/sigstore/mullvad/mullvadvpn-app-build@sha256=6239e860bc35c0eb73321df227e363fcc822eab1da4993c4a21da92a30cdbb7e/signature-2 b/building/sigstore/mullvad/mullvadvpn-app-build@sha256=6239e860bc35c0eb73321df227e363fcc822eab1da4993c4a21da92a30cdbb7e/signature-2
new file mode 100644
index 0000000000..bb948762d1
--- /dev/null
+++ b/building/sigstore/mullvad/mullvadvpn-app-build@sha256=6239e860bc35c0eb73321df227e363fcc822eab1da4993c4a21da92a30cdbb7e/signature-2
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000000..efba5d8d0f
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+# Must be greater than or equal to `rust-version` in `Cargo.toml`
+channel = "1.83.0"