diff --git a/.github/docker/ci.Dockerfile b/.github/docker/ci.Dockerfile
index 686ca85a..a79be15f 100644
--- a/.github/docker/ci.Dockerfile
+++ b/.github/docker/ci.Dockerfile
@@ -46,28 +46,37 @@ RUN rustup toolchain install nightly --profile minimal --component rustfmt
 
 # The bootstrap script only ever drops rzup in $HOME/.risc0/bin, so run it
 # against the build-time HOME and keep just the binary. rzup itself then honours
-# RISC0_HOME and installs the toolchain, r0vm and cargo-risczero under /usr/local.
+# RISC0_HOME and installs each component under /usr/local.
+#
+# Versions pinned to the set currently validated in local dev (`rzup show`);
+# bare `rzup install` would float all four default components to latest. r0vm
+# and cargo-risczero track each other and the risc0-zkvm crate version.
 RUN curl -L https://risczero.com/install | bash \
     && mv /root/.risc0/bin/rzup /usr/local/bin/rzup \
     && rm -rf /root/.risc0 \
-    && rzup install
+    && rzup install rust 1.94.1 \
+    && rzup install cpp 2024.1.5 \
+    && rzup install r0vm 3.0.5 \
+    && rzup install cargo-risczero 3.0.5
 
 # Copying docker. Static Go binaries, so the alpine-built ones run fine here.
-COPY --from=docker:29-cli /usr/local/bin/docker /usr/local/bin/docker
-COPY --from=docker:29-cli /usr/local/libexec/docker/cli-plugins/docker-compose \
+COPY --from=docker:29.6.1-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker:29.6.1-cli /usr/local/libexec/docker/cli-plugins/docker-compose \
      /usr/local/libexec/docker/cli-plugins/docker-compose
-COPY --from=docker:29-cli /usr/local/libexec/docker/cli-plugins/docker-buildx \
+COPY --from=docker:29.6.1-cli /usr/local/libexec/docker/cli-plugins/docker-buildx \
      /usr/local/libexec/docker/cli-plugins/docker-buildx
 
 # Prebuilt binaries; compiling these from source would dominate the image build.
+# Versions pinned so a rebuild of the same image ships the same tools.
+ENV BINSTALL_VERSION=1.21.0
 RUN curl -L --proto '=https' --tlsv1.2 -sSf \
       https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash \
     && cargo binstall --no-confirm \
-        cargo-nextest \
-        taplo-cli \
-        cargo-machete \
-        cargo-deny \
-        just
+        cargo-nextest@0.9.140 \
+        taplo-cli@0.10.0 \
+        cargo-machete@0.9.2 \
+        cargo-deny@0.20.2 \
+        just@1.56.0
 
 # Smoke-test every tool the jobs use. A bad install should fail here, not later
 # in some CI job that reuses this cached image. pyo3's `auto-initialize` links