diff --git a/.github/workflows/fast-check.yml b/.github/workflows/fast-check.yml
index acf9e8d..96085d8 100644
--- a/.github/workflows/fast-check.yml
+++ b/.github/workflows/fast-check.yml
@@ -42,10 +42,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Rust toolchain
+      # No toolchain name here on purpose: `rustup toolchain install` with no
+      # argument reads `rust-toolchain.toml`, so the channel this job builds
+      # with is the one the file pins -- the same one `perry-runtime` needs.
+      - name: Install the pinned Rust toolchain
         run: |
-          rustup toolchain install stable --profile minimal --component rustfmt,clippy
-          rustup default stable
+          rustup toolchain install --profile minimal
+          rustup show active-toolchain
 
       # Cargo resolves the WHOLE workspace before building any member, so
       # `perry-stdlib-shared`'s path dependency on `perry-ffi` must exist even
@@ -67,6 +70,22 @@ jobs:
           git -C .perry-main checkout --detach FETCH_HEAD
           test "$(git -C .perry-main rev-parse HEAD)" = "$commit"
 
+      # `.perry-main` is excluded from the workspace, so Perry's own
+      # `rust-toolchain.toml` never governs a cargo run made from this
+      # directory; ours has to name the same channel. Fail the bump that
+      # forgets one of the two rather than the first nightly-only build.
+      - name: Assert the toolchain pin matches Perry's
+        shell: bash
+        run: |
+          set -euo pipefail
+          ours="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
+          theirs="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' .perry-main/rust-toolchain.toml)"
+          test -n "$ours" && test -n "$theirs"
+          if [ "$ours" != "$theirs" ]; then
+            echo "::error::rust-toolchain.toml pins $ours but Perry at perry-main.lock pins $theirs"
+            exit 1
+          fi
+
       - uses: Swatinem/rust-cache@v2
         with:
           key: fast-check
diff --git a/.github/workflows/linux-shared-runtime.yml b/.github/workflows/linux-shared-runtime.yml
index f4ae74d..923a9fd 100644
--- a/.github/workflows/linux-shared-runtime.yml
+++ b/.github/workflows/linux-shared-runtime.yml
@@ -84,6 +84,24 @@ jobs:
           git -C .perry-main checkout --detach FETCH_HEAD
           test "$(git -C .perry-main rev-parse HEAD)" = "$commit"
 
+      # `rustup toolchain install` with no argument reads `rust-toolchain.toml`.
+      # This job builds perry-runtime itself (through the providers and through
+      # coop-daemon/coop-worker), so it fails outright on a channel other than
+      # the one Perry pins -- assert the two files agree before spending an hour.
+      - name: Install the pinned Rust toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          ours="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
+          theirs="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' .perry-main/rust-toolchain.toml)"
+          test -n "$ours" && test -n "$theirs"
+          if [ "$ours" != "$theirs" ]; then
+            echo "::error::rust-toolchain.toml pins $ours but Perry at perry-main.lock pins $theirs"
+            exit 1
+          fi
+          rustup toolchain install --profile minimal
+          rustup show active-toolchain
+
       - name: Build separate providers and server
         shell: bash
         run: |
diff --git a/Cargo.lock b/Cargo.lock
index fa7e1e1..1121bb6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1859,9 +1859,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid 0.9.6",
- "der_derive",
- "flagset",
- "pem-rfc7468",
+ "pem-rfc7468 0.7.0",
  "zeroize",
 ]
 
@@ -1872,6 +1870,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d"
 dependencies = [
  "const-oid 0.10.2",
+ "der_derive",
+ "flagset",
+ "pem-rfc7468 1.0.0",
  "zeroize",
 ]
 
@@ -1891,9 +1892,9 @@ dependencies = [
 
 [[package]]
 name = "der_derive"
-version = "0.7.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
+checksum = "59600e2c2d636fde9b65e99cc6445ac770c63d3628195ff39932b8d6d7409903"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2169,7 +2170,7 @@ dependencies = [
  "generic-array",
  "group 0.13.0",
  "hkdf 0.12.4",
- "pem-rfc7468",
+ "pem-rfc7468 0.7.0",
  "pkcs8 0.10.2",
  "rand_core 0.6.4",
  "sec1 0.7.3",
@@ -2761,12 +2762,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "grid"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36119f3a540b086b4e436bb2b588cf98a68863470e0e880f4d0842f112a3183a"
-
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -2879,15 +2874,6 @@ dependencies = [
  "foldhash 0.2.0",
 ]
 
-[[package]]
-name = "hashlink"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
-dependencies = [
- "hashbrown 0.15.5",
-]
-
 [[package]]
 name = "hashlink"
 version = "0.11.1"
@@ -3745,9 +3731,9 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "10.4.0"
+version = "11.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
+checksum = "881733cbc631fc9e472e24447ce32a64bedf2da498d6d8570b08edc87de71f65"
 dependencies = [
  "base64 0.22.1",
  "ed25519-dalek",
@@ -3921,9 +3907,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.35.0"
+version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
+checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
 dependencies = [
  "bindgen",
  "cc",
@@ -4731,6 +4717,15 @@ dependencies = [
  "base64ct",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -4739,7 +4734,7 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "perry-diagnostics"
-version = "0.5.1512"
+version = "0.5.1519"
 dependencies = [
  "serde",
  "serde_json",
@@ -4747,11 +4742,11 @@ dependencies = [
 
 [[package]]
 name = "perry-dispatch"
-version = "0.5.1512"
+version = "0.5.1519"
 
 [[package]]
 name = "perry-ffi"
-version = "0.5.1512"
+version = "0.5.1519"
 dependencies = [
  "dashmap",
  "once_cell",
@@ -4759,19 +4754,20 @@ dependencies = [
 
 [[package]]
 name = "perry-parser"
-version = "0.5.1512"
+version = "0.5.1519"
 dependencies = [
  "anyhow",
  "perry-diagnostics",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_parser",
+ "swc_ecma_visit",
  "thiserror 1.0.69",
 ]
 
 [[package]]
 name = "perry-runtime"
-version = "0.5.1512"
+version = "0.5.1519"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -4783,6 +4779,7 @@ dependencies = [
  "hostname",
  "icu_calendar",
  "icu_datetime",
+ "icu_locale",
  "icu_locale_core",
  "icu_time",
  "idna",
@@ -4797,10 +4794,12 @@ dependencies = [
  "perry-parser",
  "rand 0.10.2",
  "regex",
+ "regress",
  "resolv-conf",
  "ryu",
  "serde",
  "serde_json",
+ "sha2 0.11.0",
  "socket2",
  "taffy",
  "temporal_rs",
@@ -4809,11 +4808,12 @@ dependencies = [
  "unicode-segmentation",
  "url",
  "windows-sys 0.61.2",
+ "x509-cert",
 ]
 
 [[package]]
 name = "perry-stdlib"
-version = "0.5.1512"
+version = "0.5.1519"
 dependencies = [
  "aes 0.8.4",
  "aes 0.9.2",
@@ -4905,7 +4905,7 @@ dependencies = [
 
 [[package]]
 name = "perry-updater"
-version = "0.5.1512"
+version = "0.5.1519"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -5731,6 +5731,16 @@ version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
+[[package]]
+name = "regress"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "158a764437582235e3501f683b93a0a6f8d825d04a789dbe5ed30b8799b8908a"
+dependencies = [
+ "hashbrown 0.16.1",
+ "memchr",
+]
+
 [[package]]
 name = "rend"
 version = "0.4.2"
@@ -5865,18 +5875,29 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rsqlite-vfs"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "rusqlite"
-version = "0.37.0"
+version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
+checksum = "a0d2b0146dd9661bf67bb107c0bb2a55064d556eeb3fc314151b957f313bcd4e"
 dependencies = [
  "bitflags 2.11.0",
  "fallible-iterator 0.3.0",
  "fallible-streaming-iterator",
- "hashlink 0.10.0",
+ "hashlink",
  "libsqlite3-sys",
  "smallvec",
+ "sqlite-wasm-rs",
 ]
 
 [[package]]
@@ -6619,6 +6640,18 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
 
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
+dependencies = [
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "sqlx"
 version = "0.9.0"
@@ -6651,7 +6684,7 @@ dependencies = [
  "futures-io",
  "futures-util",
  "hashbrown 0.16.1",
- "hashlink 0.11.1",
+ "hashlink",
  "indexmap",
  "log",
  "memchr",
@@ -6973,6 +7006,21 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "swc_ecma_visit"
+version = "19.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69d63f7f704a2ec937edef90a3eba1f64602eceb60c8deb260c01131f680e8b"
+dependencies = [
+ "new_debug_unreachable",
+ "num-bigint",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_visit",
+ "tracing",
+]
+
 [[package]]
 name = "swc_eq_ignore_macros"
 version = "1.0.1"
@@ -7080,12 +7128,11 @@ dependencies = [
 
 [[package]]
 name = "taffy"
-version = "0.7.7"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab4f4d046dd956a47a7e1a2947083d7ac3e6aa3cfaaead36173ceaa5ab11878c"
+checksum = "c034e05f6ee85a12daa63863c2245797715075c70649947aa0da54f3f2ab1d0f"
 dependencies = [
  "arrayvec",
- "grid",
  "serde",
  "slotmap",
 ]
@@ -8565,13 +8612,13 @@ dependencies = [
 
 [[package]]
 name = "x509-cert"
-version = "0.2.5"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
+checksum = "105ef4642d9cb137ef83d623d0e4bf08b8adf69e9918ca904a174adb6d3d038b"
 dependencies = [
- "const-oid 0.9.6",
- "der 0.7.10",
- "spki 0.7.3",
+ "const-oid 0.10.2",
+ "der 0.8.1",
+ "spki 0.8.0",
 ]
 
 [[package]]
diff --git a/README.md b/README.md
index 865c878..827d14a 100644
--- a/README.md
+++ b/README.md
@@ -42,8 +42,10 @@ Two things worth knowing before you invest time:
 
 ## Quick start
 
-Requirements: a Perry checkout (pinned by `perry-main.lock`), Rust stable, and
-Node for the developer tooling.
+Requirements: a Perry checkout (pinned by `perry-main.lock`), the Rust nightly
+named in `rust-toolchain.toml` (rustup picks it up automatically; it matches
+Perry's own pin, and the two are bumped together), and Node for the developer
+tooling.
 
 ```bash
 # 1. Build the shared runtime + stdlib provider libraries once
diff --git a/crates/coop-daemon/Cargo.toml b/crates/coop-daemon/Cargo.toml
index fc44c44..c33b8a5 100644
--- a/crates/coop-daemon/Cargo.toml
+++ b/crates/coop-daemon/Cargo.toml
@@ -59,7 +59,7 @@ metrics-exporter-prometheus = "0.16"
 
 # SQLite for schema provisioning + migration runner.
 # Match perry-stdlib's version to avoid libsqlite3-sys "links" conflict.
-rusqlite = { version = "0.37", features = ["bundled"] }
+rusqlite = { version = "0.39", features = ["bundled"] }
 
 # Chrono for timestamps in admin UI
 chrono = { version = "0.4", features = ["serde"] }
diff --git a/docs/src/providers.md b/docs/src/providers.md
index 4e8a2c8..4a40569 100644
--- a/docs/src/providers.md
+++ b/docs/src/providers.md
@@ -66,9 +66,13 @@ more than a dozen commits including significant runtime changes. Pin and compare
 
 After bumping the pin:
 
-1. Rebuild the providers (`build-perry-libraries.sh`).
-2. Recompile every deployment — the identity guard will reject stale images.
-3. Confirm the provider `sha256` changed and the manifest's `perry_commit`
+1. Compare `.perry-main/rust-toolchain.toml` with the `rust-toolchain.toml` at
+   this repository's root and copy the channel across if it moved. Perry's file
+   does not govern builds run from here (`.perry-main` is excluded from the
+   workspace), and both CI workflows fail early when the two disagree.
+2. Rebuild the providers (`build-perry-libraries.sh`).
+3. Recompile every deployment — the identity guard will reject stale images.
+4. Confirm the provider `sha256` changed and the manifest's `perry_commit`
    matches the new pin.
 
 A fixture or benchmark artifact built by hand will go stale on every bump and
diff --git a/docs/src/quickstart.md b/docs/src/quickstart.md
index 5c703fb..5adfebd 100644
--- a/docs/src/quickstart.md
+++ b/docs/src/quickstart.md
@@ -6,8 +6,11 @@
   `perry-main.lock` at the repository root — the `commit` field, not the version
   string. Perry's version does not change on every commit, so it cannot tell you
   whether your checkout matches.
-- Rust stable, and the toolchain Perry itself requires (LLVM 22 for its
-  in-process backend).
+- The Rust toolchain named in `rust-toolchain.toml` at the repository root.
+  It is a dated nightly, not stable: `perry-runtime` uses nightly-only float
+  intrinsics, and because `.perry-main` is excluded from this workspace Perry's
+  own toolchain file does not apply to builds run from here. rustup installs it
+  on first use. Also LLVM 22, for Perry's in-process backend.
 - Node, for the developer tooling and test fixtures.
 
 ## 1. Build the shared providers
diff --git a/perry-main.lock b/perry-main.lock
index e1476a1..e7ce6e0 100644
--- a/perry-main.lock
+++ b/perry-main.lock
@@ -1,2 +1,2 @@
-version = "0.5.1512"
-commit = "fc6b3378807d2646c44cf54bbfa6923071850030"
+version = "0.5.1519"
+commit = "41e8479a56814306650c4ae33e9cfe55a997ba50"
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..755f960
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,12 @@
+# Coop builds Perry's crates (perry-runtime, perry-stdlib, perry-ffi) as path
+# dependencies out of `.perry-main`, and `.perry-main` is excluded from this
+# workspace — so Perry's own `rust-toolchain.toml` never applies to a cargo
+# invocation made from this directory. `perry-runtime` uses the
+# `float_algebraic` methods, which are nightly-only: on stable every build of
+# coop-daemon or coop-worker fails with E0658 as of Perry 0.5.1519 (perry#8550).
+#
+# Keep this channel identical to `.perry-main/rust-toolchain.toml` at the commit
+# `perry-main.lock` names, and bump the two together.
+[toolchain]
+channel = "nightly-2026-08-20"
+components = ["rustfmt", "clippy"]