diff --git a/.github/actions/setup-integration-test-env/action.yml b/.github/actions/setup-integration-test-env/action.yml
index 841d8d5bd9..ee71d7b708 100644
--- a/.github/actions/setup-integration-test-env/action.yml
+++ b/.github/actions/setup-integration-test-env/action.yml
@@ -34,11 +34,6 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Retrieve Rust version
-      id: rust-version
-      shell: bash
-      run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
     - name: Retrieve Node.js version
       id: node-version
       shell: bash
@@ -52,11 +47,15 @@ runs:
       run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
     - name: Set up Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: ./.github/actions/setup-rust
       with:
-        toolchain: ${{ steps.rust-version.outputs.rust-version }}
         target: wasm32-wasip1
-        cache-shared-key: cargo-${{ runner.os }}
+        # Restore the axum job's main cache: it builds the same axum debug and
+        # Fastly release WASM artifacts. Restore only: test-axum owns this key,
+        # and rust-cache never replaces an exact-match key, so a partial cache
+        # saved by a workflow_dispatch run on main would stick.
+        cache-key: cargo-axum
+        save-cache: "false"
 
     - name: Cache Viceroy binary
       if: ${{ inputs.install-viceroy == 'true' }}
diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml
new file mode 100644
index 0000000000..60c12f4829
--- /dev/null
+++ b/.github/actions/setup-rust/action.yml
@@ -0,0 +1,45 @@
+name: Set up pinned Rust
+description: Install the .tool-versions Rust toolchain with a per-job cache that only main saves.
+
+inputs:
+  cache-key:
+    description: Per-job rust-cache key prefix; the runner OS is appended.
+    required: true
+  target:
+    description: Comma-separated extra targets.
+    required: false
+    default: ""
+  components:
+    description: Comma-separated extra components.
+    required: false
+    default: ""
+  save-cache:
+    description: Set to "false" for restore-only callers.
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: Retrieve Rust version
+      id: rust-version
+      shell: bash
+      run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+    - name: Remove runner-image Rust toolchain
+      # rust-cache hashes every installed toolchain into its key, so the image's
+      # preinstalled stable would rotate the key on each runner-image rollout.
+      # Unsetting the default stops rustup from silently reinstalling stable
+      # when cargo runs outside the checkout.
+      shell: bash
+      run: if command -v rustup >/dev/null; then rustup toolchain uninstall stable && rustup default none; fi
+
+    - name: Set up Rust toolchain
+      uses: actions-rust-lang/setup-rust-toolchain@v1
+      with:
+        toolchain: ${{ steps.rust-version.outputs.rust-version }}
+        target: ${{ inputs.target }}
+        components: ${{ inputs.components }}
+        cache-shared-key: ${{ inputs.cache-key }}-${{ runner.os }}
+        # PR caches are scoped to their ref and only evict main's shared caches.
+        cache-save-if: ${{ inputs.save-cache == 'true' && github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index f5c033649b..f458572eb7 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -45,18 +45,24 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+      # Rust jobs must set up the toolchain through ./.github/actions/setup-rust,
+      # which removes the image's stable and only saves caches from main. A
+      # direct setup-rust-toolchain or rust-cache step skips both silently.
+      - name: Require the shared Rust setup action
         shell: bash
+        run: |
+          if grep -rnE "uses:[[:space:]]*[\"']?(actions-rust-lang/setup-rust-toolchain|Swatinem/rust-cache)@" .github \
+              | grep -v '^\.github/actions/setup-rust/action\.yml:'; then
+            echo "::error::Set up Rust with ./.github/actions/setup-rust, not setup-rust-toolchain or rust-cache directly."
+            exit 1
+          fi
 
       - name: Set up rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: ./.github/actions/setup-rust
         with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
           target: wasm32-wasip1,wasm32-unknown-unknown
           components: "clippy, rustfmt"
-          cache-shared-key: cargo-${{ runner.os }}
+          cache-key: cargo-clippy
 
       - name: Run cargo fmt
         uses: actions-rust-lang/rustfmt@v1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 95654ecddf..b27173dd66 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,11 +16,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
       - name: Retrieve Viceroy version
         id: viceroy-version
         # `.tool-versions` is the single source of truth so this workflow and
@@ -34,11 +29,10 @@ jobs:
         shell: bash
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: ./.github/actions/setup-rust
         with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
           target: wasm32-wasip1
-          cache-shared-key: cargo-${{ runner.os }}
+          cache-key: cargo-fastly
 
       - name: Cache Viceroy binary
         id: cache-viceroy
@@ -77,19 +71,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: ./.github/actions/setup-rust
         with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
           # wasm32-wasip1 is required by the "Verify Fastly WASM release
           # build" step below; the axum build and tests are native.
           target: wasm32-wasip1
-          cache-shared-key: cargo-${{ runner.os }}
+          cache-key: cargo-axum
 
       - name: Read pinned Node.js version for CLI fixtures
         id: node-version
@@ -131,17 +119,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
       - name: Set up Rust toolchain (native + wasm32-unknown-unknown)
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: ./.github/actions/setup-rust
         with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
           target: wasm32-unknown-unknown
-          cache-shared-key: cargo-${{ runner.os }}
+          cache-key: cargo-cloudflare
 
       - name: Check Cloudflare adapter (native host)
         run: cargo check -p trusted-server-adapter-cloudflare
@@ -158,17 +140,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
       - name: Set up Rust toolchain (native + wasm32-wasip1)
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: ./.github/actions/setup-rust
         with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
           target: wasm32-wasip1
-          cache-shared-key: cargo-${{ runner.os }}
+          cache-key: cargo-spin
 
       - name: Check Spin adapter (native host)
         run: cargo check -p trusted-server-adapter-spin
@@ -197,17 +173,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: ./.github/actions/setup-rust
         with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
           components: clippy, rustfmt
-          cache-shared-key: cargo-${{ runner.os }}
+          cache-key: cargo-parity
 
       - name: Format check (parity test crate)
         run: cargo fmt --manifest-path crates/trusted-server-integration-tests/Cargo.toml -- --check
@@ -228,17 +198,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Retrieve Rust version
-        id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
-        shell: bash
-
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: ./.github/actions/setup-rust
         with:
-          toolchain: ${{ steps.rust-version.outputs.rust-version }}
           components: "clippy, rustfmt"
-          cache-shared-key: cargo-cli-${{ runner.os }}
+          cache-key: cargo-cli
 
       - name: Read pinned Node.js version for CLI fixtures
         id: node-version