diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 610a6a4..359cd43 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -12,10 +12,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install pinned Rust toolchain
+      # The version is read from rust-toolchain.toml rather than written here.
+      # That file is the single declaration, and naming the version twice lets
+      # CI and a developer drift onto different compilers without either of
+      # them noticing -- which is the whole failure this indirection prevents.
+      - name: Read the pinned toolchain
+        id: toolchain
+        run: |
+          channel="$(sed -n 's/^channel = "\(.*\)"$/\1/p' rust-toolchain.toml)"
+          test -n "$channel" || { echo "no channel in rust-toolchain.toml" >&2; exit 1; }
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
+      - name: Install the pinned Rust toolchain
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.94.1
+          toolchain: ${{ steps.toolchain.outputs.channel }}
           components: rustfmt, clippy
 
       - name: Cache cargo
@@ -27,7 +38,30 @@ jobs:
             target
           key: headless-${{ hashFiles('Cargo.lock') }}
 
+
+      # The gates cannot be allowed to skip themselves. Both tools ship prebuilt
+      # binaries; building cargo-deny from source on this runner would cost more
+      # than the job it guards. LUMBRIDGE_CI_STRICT below turns a missing tool
+      # from a warning into a failure, so a silent skip cannot read as green.
+      - name: Install gate tooling
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.local/bin"
+          arch="$(uname -m)"
+          case "$arch" in
+            x86_64) nextest_arch=x86_64-unknown-linux-gnu; deny_arch=x86_64-unknown-linux-musl ;;
+            aarch64) nextest_arch=aarch64-unknown-linux-gnu; deny_arch=aarch64-unknown-linux-musl ;;
+            *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
+          esac
+          curl -fsSL "https://get.nexte.st/latest/$nextest_arch" | tar zxf - -C "$HOME/.local/bin"
+          deny_version=0.18.6
+          curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
+            | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - name: Headless checks
+        env:
+          LUMBRIDGE_CI_STRICT: "1"
         run: ./scripts/ci.sh --headless
 
   # The GPUI product. Kept separate because it pulls a window toolkit, several
@@ -46,10 +80,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install pinned Rust toolchain
+      # The version is read from rust-toolchain.toml rather than written here.
+      # That file is the single declaration, and naming the version twice lets
+      # CI and a developer drift onto different compilers without either of
+      # them noticing -- which is the whole failure this indirection prevents.
+      - name: Read the pinned toolchain
+        id: toolchain
+        run: |
+          channel="$(sed -n 's/^channel = "\(.*\)"$/\1/p' rust-toolchain.toml)"
+          test -n "$channel" || { echo "no channel in rust-toolchain.toml" >&2; exit 1; }
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
+      - name: Install the pinned Rust toolchain
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.94.1
+          toolchain: ${{ steps.toolchain.outputs.channel }}
           components: rustfmt, clippy
 
       # GPUI's X11 backend links against these. libxkbcommon-x11-dev is the
@@ -73,7 +118,30 @@ jobs:
       - name: Report disk before build
         run: df -h .
 
+
+      # The gates cannot be allowed to skip themselves. Both tools ship prebuilt
+      # binaries; building cargo-deny from source on this runner would cost more
+      # than the job it guards. LUMBRIDGE_CI_STRICT below turns a missing tool
+      # from a warning into a failure, so a silent skip cannot read as green.
+      - name: Install gate tooling
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.local/bin"
+          arch="$(uname -m)"
+          case "$arch" in
+            x86_64) nextest_arch=x86_64-unknown-linux-gnu; deny_arch=x86_64-unknown-linux-musl ;;
+            aarch64) nextest_arch=aarch64-unknown-linux-gnu; deny_arch=aarch64-unknown-linux-musl ;;
+            *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
+          esac
+          curl -fsSL "https://get.nexte.st/latest/$nextest_arch" | tar zxf - -C "$HOME/.local/bin"
+          deny_version=0.18.6
+          curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
+            | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - name: UI checks
+        env:
+          LUMBRIDGE_CI_STRICT: "1"
         run: ./scripts/ci.sh --ui
 
       - name: Report disk after build