diff --git a/scripts/ci/cuda/ci_install_dependency.sh b/scripts/ci/cuda/ci_install_dependency.sh
index 3c78b1be9..1e8faa710 100755
--- a/scripts/ci/cuda/ci_install_dependency.sh
+++ b/scripts/ci/cuda/ci_install_dependency.sh
@@ -175,6 +175,17 @@ clean_site_packages() {
     bash "${SCRIPT_DIR}/../utils/install_rust_protoc.sh"
     export PATH="${CARGO_HOME:-$HOME/.cargo}/bin:${PATH}"
 
+    # Same-step counterpart of the PATH export above: install_rustup.sh exports
+    # RUSTUP_TOOLCHAIN too, but as a child process only reaches later steps.
+    # rust-toolchain.toml does not cover it either - setuptools-rust runs cargo
+    # from python/, outside the pin's cwd scope - so without this an image's own
+    # older rustc builds the crates and fails their MSRV.
+    RUST_PINNED_CHANNEL=$(sed -n 's/^channel *= *"\([^"]*\)".*/\1/p' "${REPO_ROOT}/rust/rust-toolchain.toml" 2>/dev/null || true)
+    if [ -n "${RUST_PINNED_CHANNEL}" ]; then
+        export RUSTUP_TOOLCHAIN="${RUST_PINNED_CHANNEL}"
+        echo "Using pinned Rust toolchain ${RUST_PINNED_CHANNEL} for this install"
+    fi
+
     mark_step_done "${FUNCNAME[0]}"
 }
 
diff --git a/scripts/ci/utils/install_rustup.sh b/scripts/ci/utils/install_rustup.sh
index 660634d52..d93452d2b 100755
--- a/scripts/ci/utils/install_rustup.sh
+++ b/scripts/ci/utils/install_rustup.sh
@@ -125,5 +125,20 @@ fi
 
 install_workspace_pinned_toolchain
 
+# An image that already ships a usable rustc takes the "rust already installed"
+# path above, leaving its own toolchain selected so crates needing the pin fail.
+#
+# RUSTUP_TOOLCHAIN rather than `rustup default`: the latter rewrites the shared
+# ~/.rustup on this self-hosted runner, which concurrent jobs would race on. It
+# also outranks rust-toolchain.toml, so it covers cargo runs started outside
+# rust/, which is how setuptools-rust invokes it. As a child process this only
+# reaches later steps; same-step builders export it themselves.
+export RUSTUP_TOOLCHAIN="${DEFAULT_CHANNEL}"
+if [ -n "${GITHUB_ENV:-}" ]; then
+    # Self-heal a missing _runner_file_commands/, as with GITHUB_PATH above.
+    mkdir -p "$(dirname "${GITHUB_ENV}")" 2>/dev/null || true
+    echo "RUSTUP_TOOLCHAIN=${DEFAULT_CHANNEL}" >> "${GITHUB_ENV}" || true
+fi
+
 rustc --version
 cargo --version