diff --git a/scripts/cargo-binstall.sha256 b/scripts/cargo-binstall.sha256
new file mode 100644
index 0000000..f89effd
--- /dev/null
+++ b/scripts/cargo-binstall.sha256
@@ -0,0 +1,9 @@
+# cargo-binstall release assets for v1.21.1
+# (https://github.com/cargo-bins/cargo-binstall/releases/tag/v1.21.1),
+# recorded from downloads cross-checked against the GitHub release API's
+# published digests. `setup.sh` refuses an asset that does not match, and
+# platforms not listed here fall back to `cargo install --locked`.
+# Format: <sha256>  <asset>  (sha256sum -c compatible)
+630c8f8803a686aa6779497f0f0fb51d49822fb5fc3c514d8ced33b34e338e6e  cargo-binstall-x86_64-unknown-linux-musl.tgz
+1dc2979f3c83aade9a1b4344589d14fafa63459b759222528d11419f5cca9cc2  cargo-binstall-aarch64-unknown-linux-musl.tgz
+392ec16ab05887f45c6c349f1d26d7f43a340f7bd04dc5db6f455d1f50d9b09b  cargo-binstall-universal-apple-darwin.zip
diff --git a/scripts/setup.sh b/scripts/setup.sh
index f16b57d..8d910fd 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -3,7 +3,10 @@
 #
 # Installs (skipping anything already on PATH):
 #   - the Rust toolchain pinned by rust-toolchain.toml (via rustup)
-#   - wasm-tools, wac, just (via cargo-binstall, versions pinned below)
+#   - wasm-tools, wac, just (via cargo-binstall, versions pinned below;
+#     cargo-binstall itself arrives as a release asset pinned by version
+#     and digest — scripts/cargo-binstall.sha256 — never via a floating
+#     bootstrap script)
 #   - pnpm (via npm, version pinned below)
 #   - JS dependencies for the package trees (skipped with SKIP_NODE=1);
 #     the jco toolchain arrives as a prebuilt release-asset tarball
@@ -44,9 +47,71 @@ fi
 (cd "$REPO_ROOT" && (rustup show active-toolchain >/dev/null 2>&1 || rustup toolchain install))
 
 # cargo-binstall bootstraps the pinned cargo tools without compiling them.
+# It is itself pinned: the release asset for this platform is downloaded
+# directly and verified against scripts/cargo-binstall.sha256 before it
+# runs. Bumping the version means re-recording those digests deliberately.
+BINSTALL_VERSION="1.21.1"
+
+sha256_of() {
+    if have sha256sum; then
+        sha256sum "$1" | cut -d' ' -f1
+    else
+        shasum -a 256 "$1" | cut -d' ' -f1
+    fi
+}
+
+install_binstall() {
+    local asset
+    case "$(uname -s)-$(uname -m)" in
+    Linux-x86_64) asset="cargo-binstall-x86_64-unknown-linux-musl.tgz" ;;
+    Linux-aarch64) asset="cargo-binstall-aarch64-unknown-linux-musl.tgz" ;;
+    Darwin-*) asset="cargo-binstall-universal-apple-darwin.zip" ;;
+    *) asset="" ;;
+    esac
+    if [ -z "$asset" ]; then
+        echo "setup: no pinned cargo-binstall asset for $(uname -s)/$(uname -m); building from crates.io (registry checksums)" >&2
+        cargo install cargo-binstall --locked --version "$BINSTALL_VERSION"
+        return
+    fi
+
+    local want
+    want="$(grep -v '^#' "$REPO_ROOT/scripts/cargo-binstall.sha256" | awk -v a="$asset" '$2 == a { print $1 }')"
+    if [ -z "$want" ]; then
+        echo "setup: scripts/cargo-binstall.sha256 pins no digest for ${asset}; record it deliberately" >&2
+        exit 1
+    fi
+
+    local tmp
+    tmp="$(mktemp -d)"
+    curl -fsSL --proto '=https' --tlsv1.2 -o "${tmp}/${asset}" \
+        "https://github.com/cargo-bins/cargo-binstall/releases/download/v${BINSTALL_VERSION}/${asset}"
+
+    local got
+    got="$(sha256_of "${tmp}/${asset}")"
+    if [ "$got" != "$want" ]; then
+        rm -rf "$tmp"
+        cat >&2 <<EOF
+setup: ${asset} does not match the digest pinned for cargo-binstall ${BINSTALL_VERSION}.
+  expected ${want}
+  actual   ${got}
+
+The download has been removed. Either the published asset was replaced,
+the pin is stale, or the download was tampered with. Re-record the
+digests deliberately after establishing why they changed.
+EOF
+        exit 1
+    fi
+
+    mkdir -p "$HOME/.cargo/bin"
+    case "$asset" in
+    *.tgz) tar -xzf "${tmp}/${asset}" -C "$HOME/.cargo/bin" cargo-binstall ;;
+    *.zip) unzip -q -o "${tmp}/${asset}" cargo-binstall -d "$HOME/.cargo/bin" ;;
+    esac
+    rm -rf "$tmp"
+}
+
 if ! have cargo-binstall; then
-    curl -L --proto '=https' --tlsv1.2 -sSf \
-        https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+    install_binstall
 fi
 
 # --force: a restored CI cache can contain cargo's install metadata without