diff --git a/.github/actions/setup-integration-test-env/action.yml b/.github/actions/setup-integration-test-env/action.yml
index e61d129b3..87c59d2fd 100644
--- a/.github/actions/setup-integration-test-env/action.yml
+++ b/.github/actions/setup-integration-test-env/action.yml
@@ -45,6 +45,15 @@ runs:
       shell: bash
       run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
+    - name: Retrieve Viceroy version
+      id: viceroy-version
+      if: ${{ inputs.install-viceroy == 'true' }}
+      shell: bash
+      # `.tool-versions` is the single source of truth for the Viceroy pin.
+      # The pin matters because upstream Viceroy > v0.16.4 has bumped MSRV
+      # beyond the rustc pin in `rust-toolchain.toml`.
+      run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
     - name: Set up Rust toolchain
       uses: actions-rust-lang/setup-rust-toolchain@v1
       with:
@@ -58,12 +67,12 @@ runs:
       uses: actions/cache@v4
       with:
         path: ~/.cargo/bin/viceroy
-        key: viceroy-${{ runner.os }}-v0.16.4
+        key: viceroy-${{ runner.os }}-v${{ steps.viceroy-version.outputs.viceroy-version }}
 
     - name: Install Viceroy
       if: ${{ inputs.install-viceroy == 'true' && steps.cache-viceroy.outputs.cache-hit != 'true' }}
       shell: bash
-      run: cargo install --git https://github.com/fastly/Viceroy --tag v0.16.4 viceroy
+      run: cargo install --git https://github.com/fastly/Viceroy --tag v${{ steps.viceroy-version.outputs.viceroy-version }} viceroy
 
     - name: Build WASM binary
       if: ${{ inputs.build-wasm == 'true' }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5eea36a74..186569da5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,6 +21,15 @@ jobs:
         run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
         shell: bash
 
+      - name: Retrieve Viceroy version
+        id: viceroy-version
+        # `.tool-versions` is the single source of truth so this workflow and
+        # `.github/actions/setup-integration-test-env/action.yml` can't drift.
+        # The pin matters because upstream Viceroy > v0.16.4 has bumped MSRV
+        # beyond the rustc pin in `rust-toolchain.toml`.
+        run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
       - name: Set up Rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -28,20 +37,16 @@ jobs:
           target: wasm32-wasip1
           cache-shared-key: cargo-${{ runner.os }}
 
-      - name: Get Viceroy cache key
-        id: viceroy-rev
-        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
-
       - name: Cache Viceroy binary
         id: cache-viceroy
         uses: actions/cache@v4
         with:
           path: ~/.cargo/bin/viceroy
-          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
+          key: viceroy-${{ runner.os }}-v${{ steps.viceroy-version.outputs.viceroy-version }}
 
-      - name: Install Viceroy (from main since 0.14.3 is broken)
+      - name: Install Viceroy
         if: steps.cache-viceroy.outputs.cache-hit != 'true'
-        run: cargo install --git https://github.com/fastly/Viceroy viceroy
+        run: cargo install --git https://github.com/fastly/Viceroy --tag v${{ steps.viceroy-version.outputs.viceroy-version }} viceroy
 
       - name: Run tests
         run: cargo test --workspace
diff --git a/.tool-versions b/.tool-versions
index 0828da5bc..8d8751b80 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,3 +1,4 @@
 fastly 13.3.0
 rust 1.91.1
 nodejs 24.12.0
+viceroy 0.16.4