diff --git a/AGENTS.md b/AGENTS.md
index 0562b4d..adf40b3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -34,7 +34,7 @@ Unix sockets. You are implementing it one task at a time.
 
 ## Code rules
 
-- Rust stable, edition 2024, `rust-version = "1.95"`. No `unsafe`. No async runtime.
+- Rust stable, edition 2024, `rust-version = "1.98"`. No `unsafe`. No async runtime.
 - No dependency that the task file does not name. All external dependencies are declared in the
   root `Cargo.toml` under `[workspace.dependencies]`, used with `name.workspace = true`, and have a
   row in `docs/dependencies.md`.
diff --git a/Cargo.toml b/Cargo.toml
index 93c6386..3a4ebd0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ members = [
 
 [workspace.package]
 edition = "2024"
-rust-version = "1.95"
+rust-version = "1.98"
 publish = false
 
 [workspace.lints.rust]
diff --git a/docs/dependencies.md b/docs/dependencies.md
index f7bceed..09aad3e 100644
--- a/docs/dependencies.md
+++ b/docs/dependencies.md
@@ -25,10 +25,16 @@ Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
 
 ## Build inputs
 
-`flake.nix` has one input, `nixpkgs`, pinned to `nixos-26.05` in `flake.lock`: the release the
-owner's NixOS hosts run, so a host's config can use the flake with
-`inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`. It has Rust 1.95.0, the workspace's
-`rust-version`. Nix fetches it when building, never the harness when running, so it is not in
+`flake.nix` has two inputs, pinned in `flake.lock`:
+
+- `nixpkgs`, `nixos-26.05`: the release the owner's NixOS hosts run, so a host's config can use
+  the flake with `inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`;
+- `rust-overlay` (github.com/oxalica/rust-overlay, MIT), following that `nixpkgs`: the Rust
+  toolchain, pinned to 1.98.1, the workspace's `rust-version` and the version titan and talos run
+  (owner, 2026-09-27), so every host builds and lints with the same compiler and clippy. The
+  release's own Rust is 1.95.0.
+
+Nix fetches them when building, never the harness when running, so they are not in
 `docs/egress.md`.
 
 - `nix build` builds every binary (`result/bin/`); the tests are not run there, only in `make gate`.
diff --git a/docs/plans/M5c1/README.md b/docs/plans/M5c1/README.md
index a057d79..2685fa2 100644
--- a/docs/plans/M5c1/README.md
+++ b/docs/plans/M5c1/README.md
@@ -13,7 +13,7 @@ session-state question; `loopd`, `gatewayd` and `bxctl chat` carry the speaker;
 the question on a new socket; `memoryd` gains a `honcho` module (configuration, ledger, decision,
 `roncho` clients, a sync worker, mirrored memory writes) and `bxctl memory sync` shows its state.
 
-**Tech stack:** Rust 1.95, edition 2024; `roncho` 1.0.0 (`default-features = false, features =
+**Tech stack:** Rust 1.98, edition 2024; `roncho` 1.0.0 (`default-features = false, features =
 ["blocking"]`), added by the design model in task 00; no other new crate.
 
 **Spec:** `docs/specs/2026-09-27-m5c-honcho.md` (approved 2026-09-27), sections 3 to 7 and 10 to
diff --git a/flake.lock b/flake.lock
index 7669fd9..57963c7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -16,7 +16,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790495762,
+        "narHash": "sha256-26FbceKgybcbwkIvs2yHsF5jHcWLEkITYg5g9WPSy64=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "edea2d6f98b1e5f64ce5ac21e19a96c603c20b8c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 5a4edc8..3d8ffc4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,13 +1,40 @@
 {
   description = "boxmaker: a sovereign personal agent harness";
 
-  inputs.nixpkgs.url = "nixpkgs/nixos-26.05";
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-26.05";
+    # The Rust toolchain, pinned below, independent of the host's nixpkgs release.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { self, nixpkgs }:
+    {
+      self,
+      nixpkgs,
+      rust-overlay,
+    }:
     let
       systems = [ "x86_64-linux" ];
       forAllSystems = nixpkgs.lib.genAttrs systems;
+      # nixpkgs with rust-overlay, and the one Rust toolchain every host uses (the workspace's
+      # `rust-version`): cargo, rustc, clippy and rustfmt.
+      pkgsFor =
+        system:
+        import nixpkgs {
+          inherit system;
+          overlays = [ rust-overlay.overlays.default ];
+        };
+      toolchainFor =
+        pkgs:
+        pkgs.rust-bin.stable."1.98.1".default.override {
+          extensions = [
+            "clippy"
+            "rustfmt"
+          ];
+        };
       version =
         if self ? shortRev then
           self.shortRev
@@ -20,7 +47,12 @@
       packages = forAllSystems (
         system:
         let
-          pkgs = nixpkgs.legacyPackages.${system};
+          pkgs = pkgsFor system;
+          toolchain = toolchainFor pkgs;
+          rustPlatform = pkgs.makeRustPlatform {
+            cargo = toolchain;
+            rustc = toolchain;
+          };
           lib = pkgs.lib;
           # Only what the build reads: no target/, no .state/, no docs.
           src = lib.cleanSourceWith {
@@ -33,7 +65,7 @@
               rel == "Cargo.toml" || rel == "Cargo.lock" || rel == "crates" || lib.hasPrefix "crates/" rel;
           };
           # Every binary of the workspace: the roles, bxctl and toolkit.
-          boxmaker = pkgs.rustPlatform.buildRustPackage {
+          boxmaker = rustPlatform.buildRustPackage {
             pname = "boxmaker";
             inherit version src;
             cargoLock.lockFile = ./Cargo.lock;
@@ -57,15 +89,12 @@
       devShells = forAllSystems (
         system:
         let
-          pkgs = nixpkgs.legacyPackages.${system};
+          pkgs = pkgsFor system;
         in
         {
           default = pkgs.mkShell {
             nativeBuildInputs = [
-              pkgs.cargo
-              pkgs.rustc
-              pkgs.clippy
-              pkgs.rustfmt
+              (toolchainFor pkgs)
               pkgs.cargo-deny
               pkgs.gnumake
             ];