diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b7fdb21..e7bfca2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,24 +5,34 @@ on:
     branches: [master]
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   ci:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
+      # Keep in sync with rust-toolchain.toml.
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
+          toolchain: 1.99.0
           components: rustfmt, clippy
           targets: thumbv7em-none-eabihf
 
       - name: Cache cargo registry and target
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Run CI gate
         run: sh scripts/ci.sh
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 292fe49..d830404 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,2 +1,6 @@
 [toolchain]
-channel = "stable"
+# Pinned so new clippy lints or rustfmt rules can't break CI without a code
+# change. Bump deliberately, together with the version in ci.yml.
+channel = "1.99.0"
+components = ["rustfmt", "clippy"]
+targets = ["thumbv7em-none-eabihf"]
diff --git a/scripts/check-no-std.sh b/scripts/check-no-std.sh
index 1b76258..26cf085 100755
--- a/scripts/check-no-std.sh
+++ b/scripts/check-no-std.sh
@@ -1,4 +1,7 @@
 #!/bin/sh
 set -e
-rustup target add thumbv7em-none-eabihf
-cargo build -p tines-core --no-default-features --target thumbv7em-none-eabihf
+target=thumbv7em-none-eabihf
+if ! rustup target list --installed | grep -qx "$target"; then
+    rustup target add "$target"
+fi
+cargo build --locked -p tines-core --no-default-features --target "$target"
diff --git a/scripts/ci.sh b/scripts/ci.sh
index 87b7de1..f2a3444 100755
--- a/scripts/ci.sh
+++ b/scripts/ci.sh
@@ -1,7 +1,10 @@
 #!/bin/sh
 set -e
 cargo fmt --all -- --check
-cargo clippy --workspace --all-targets -- -D warnings
-cargo doc --workspace --no-deps
-cargo test --workspace
+cargo clippy --locked --workspace --all-targets -- -D warnings
+cargo clippy --locked -p tines-core --no-default-features --all-targets -- -D warnings
+RUSTDOCFLAGS="-D warnings" cargo doc --locked --workspace --no-deps
+RUSTDOCFLAGS="-D warnings" cargo doc --locked -p tines-core --no-deps --no-default-features
+cargo test --locked --workspace
+cargo test --locked -p tines-core --no-default-features
 sh scripts/check-no-std.sh
diff --git a/tines-core/src/exchange.rs b/tines-core/src/exchange.rs
index 79c21c2..c28c9b2 100644
--- a/tines-core/src/exchange.rs
+++ b/tines-core/src/exchange.rs
@@ -572,7 +572,7 @@ fn insert_pos(heap: &Vec<(ObservationId, u64), { consts::SEND_QUEUE_CAP }>, age:
     pos
 }
 
-#[cfg(test)]
+#[cfg(all(test, feature = "alloc"))]
 mod tests {
     use super::*;
     use crate::{MemStore, Observation, Payload, Topic};
diff --git a/tines-core/src/store.rs b/tines-core/src/store.rs
index 09ae372..ab77ea6 100644
--- a/tines-core/src/store.rs
+++ b/tines-core/src/store.rs
@@ -2,9 +2,9 @@
 //!
 //! This module defines the [`Store`] trait plus its [`TrimPolicy`] and
 //! [`StoreError`] types. Everything here is `#![no_std]`-clean and does **not**
-//! require the `alloc` feature — only concrete backends (see
-//! [`mem_store`](crate::mem_store)) need allocation, so the trait, policy, and
-//! error types remain available on `no_std` targets as well.
+//! require the `alloc` feature — only concrete backends (such as `mem_store`,
+//! which is compiled only with `alloc`) need allocation, so the trait, policy,
+//! and error types remain available on `no_std` targets as well.
 
 use crate::observation::{Observation, ObservationId, Tick};
 
diff --git a/tines-core/tests/pair.rs b/tines-core/tests/pair.rs
index b3c6868..88560bf 100644
--- a/tines-core/tests/pair.rs
+++ b/tines-core/tests/pair.rs
@@ -1,3 +1,6 @@
+// Every test here drives a `Node` over `MemStore`, which needs `alloc`.
+#![cfg(feature = "alloc")]
+
 mod common;
 use common::PairTransport;