diff --git a/scripts/cargo-binstall.sha256 b/scripts/cargo-binstall.sha256
new file mode 100644
index 0000000..f89effd
--- /dev/null
+++ b/scripts/cargo-binstall.sha256
@@ -0,0 +1,9 @@
+# cargo-binstall release assets for v1.21.1
+# (https://github.com/cargo-bins/cargo-binstall/releases/tag/v1.21.1),
+# recorded from downloads cross-checked against the GitHub release API's
+# published digests. `setup.sh` refuses an asset that does not match, and
+# platforms not listed here fall back to `cargo install --locked`.
+# Format: <sha256>  <asset>  (sha256sum -c compatible)
+630c8f8803a686aa6779497f0f0fb51d49822fb5fc3c514d8ced33b34e338e6e  cargo-binstall-x86_64-unknown-linux-musl.tgz
+1dc2979f3c83aade9a1b4344589d14fafa63459b759222528d11419f5cca9cc2  cargo-binstall-aarch64-unknown-linux-musl.tgz
+392ec16ab05887f45c6c349f1d26d7f43a340f7bd04dc5db6f455d1f50d9b09b  cargo-binstall-universal-apple-darwin.zip
diff --git a/scripts/setup.sh b/scripts/setup.sh
index 7551ccc..eff5d42 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -41,10 +41,73 @@ log "Installing the pinned Rust toolchain and wasm targets (rust-toolchain.toml)
 have() { command -v "$1" >/dev/null 2>&1; }
 
 # Bootstrap cargo-binstall (prebuilt binaries; falls back to cargo install).
+# It is itself pinned: the release asset for this platform is downloaded
+# directly and verified against scripts/cargo-binstall.sha256 before it
+# runs — never a floating bootstrap script. Bumping the version means
+# re-recording those digests deliberately.
+BINSTALL_VERSION="1.21.1"
+
+sha256_of() {
+    if have sha256sum; then
+        sha256sum "$1" | cut -d' ' -f1
+    else
+        shasum -a 256 "$1" | cut -d' ' -f1
+    fi
+}
+
+install_binstall() {
+    local asset
+    case "$(uname -s)-$(uname -m)" in
+    Linux-x86_64) asset="cargo-binstall-x86_64-unknown-linux-musl.tgz" ;;
+    Linux-aarch64) asset="cargo-binstall-aarch64-unknown-linux-musl.tgz" ;;
+    Darwin-*) asset="cargo-binstall-universal-apple-darwin.zip" ;;
+    *) asset="" ;;
+    esac
+    if [ -z "$asset" ]; then
+        echo "setup: no pinned cargo-binstall asset for $(uname -s)/$(uname -m); building from crates.io (registry checksums)" >&2
+        cargo install cargo-binstall --locked --version "$BINSTALL_VERSION"
+        return
+    fi
+
+    local want
+    want="$(grep -v '^#' "$REPO_ROOT/scripts/cargo-binstall.sha256" | awk -v a="$asset" '$2 == a { print $1 }')"
+    if [ -z "$want" ]; then
+        echo "setup: scripts/cargo-binstall.sha256 pins no digest for ${asset}; record it deliberately" >&2
+        exit 1
+    fi
+
+    local tmp
+    tmp="$(mktemp -d)"
+    curl -fsSL --proto '=https' --tlsv1.2 -o "${tmp}/${asset}" \
+        "https://github.com/cargo-bins/cargo-binstall/releases/download/v${BINSTALL_VERSION}/${asset}"
+
+    local got
+    got="$(sha256_of "${tmp}/${asset}")"
+    if [ "$got" != "$want" ]; then
+        rm -rf "$tmp"
+        cat >&2 <<EOF
+setup: ${asset} does not match the digest pinned for cargo-binstall ${BINSTALL_VERSION}.
+  expected ${want}
+  actual   ${got}
+
+The download has been removed. Either the published asset was replaced,
+the pin is stale, or the download was tampered with. Re-record the
+digests deliberately after establishing why they changed.
+EOF
+        exit 1
+    fi
+
+    mkdir -p "$HOME/.cargo/bin"
+    case "$asset" in
+    *.tgz) tar -xzf "${tmp}/${asset}" -C "$HOME/.cargo/bin" cargo-binstall ;;
+    *.zip) unzip -q -o "${tmp}/${asset}" cargo-binstall -d "$HOME/.cargo/bin" ;;
+    esac
+    rm -rf "$tmp"
+}
+
 if ! have cargo-binstall; then
-    log "Installing cargo-binstall"
-    curl -L --proto '=https' --tlsv1.2 -sSf \
-        https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+    log "Installing cargo-binstall ${BINSTALL_VERSION}"
+    install_binstall
 fi
 
 if ! have wasm-tools; then