diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3f758c3d..3a2e302c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -15,7 +15,9 @@ module boundary.
 
 ## Workspace and toolchain
 
-The repository is one Cargo workspace using Rust 1.95 and edition 2024:
+The repository is one Cargo workspace using Rust 1.95 and edition 2024. The
+Nix flake compiles with `nixpkgs` rustc from `flake.lock`; after raising
+`rust-version`, run `nix flake update` so that lock is new enough.
 
 - the root `wayscriber` package owns the overlay, daemon, CLI, shared domain/config/session code,
   rendering, and integration tests;
diff --git a/flake.lock b/flake.lock
index c7594333..de06ac71 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "lastModified": 1786862985,
+        "narHash": "sha256-FBJRXmbGXiSUDvYEbfLYRkckayyZ6SK1UEqhCrIZ2Cs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "e5bdc4a41d4c072fe1e3787eaa0320a384741d44",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index e5196f52..2317c89c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,12 +7,22 @@
   };
 
   outputs = { self, nixpkgs, flake-utils }:
-    flake-utils.lib.eachDefaultSystem (system:
+    # Linux only. eachDefaultSystem also evaluates x86_64-darwin, which
+    # nixpkgs 26.11 dropped.
+    flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system:
       let
         pkgs = import nixpkgs { inherit system; };
-        version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.version;
+        cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
+        version = cargoToml.package.version;
+        rustVersion = cargoToml.package.rust-version;
         servicePath = pkgs.lib.makeBinPath [ pkgs.grim pkgs.slurp pkgs.wl-clipboard ];
-      in {
+      in
+      # Instantiation (and CI `nix eval`) must fail before cargoBuildHook
+      # when flake.lock's nixpkgs rustc lags Cargo.toml's rust-version.
+      assert pkgs.lib.assertMsg
+        (pkgs.lib.versionAtLeast pkgs.rustc.version rustVersion)
+        "nixpkgs rustc ${pkgs.rustc.version} is older than Cargo.toml rust-version ${rustVersion}; run `nix flake update`.";
+      {
         packages = {
           wayscriber = pkgs.rustPlatform.buildRustPackage {
             pname = "wayscriber";
diff --git a/tools/README.md b/tools/README.md
index df958921..bdf51181 100644
--- a/tools/README.md
+++ b/tools/README.md
@@ -64,7 +64,7 @@ Helper scripts for development, installation, packaging, and release workflows.
   - Usage: `./tools/bump-version.sh [--dry-run] [new_version]`
 
 - **check-version-consistency.sh** - Check release metadata alignment
-  - Verifies Cargo manifests, the workspace lockfile, packaging metadata, and flake version sourcing
+  - Verifies Cargo manifests, the workspace lockfile, packaging metadata, flake version sourcing, and that the flake compares nixpkgs rustc to Cargo.toml rust-version
   - Keeps the configurator's libadwaita 1.4 floor aligned across Cargo, deb, rpm, PKGBUILD, and `.SRCINFO`
   - With `--release-version X.Y.Z[.N]`, rejects tags that do not match Cargo or an explicit packaging hotfix of Cargo
   - Usage: `bash tools/check-version-consistency.sh [--release-version X.Y.Z[.N]]`
diff --git a/tools/check-version-consistency.sh b/tools/check-version-consistency.sh
index 984c7f9e..00e4a995 100755
--- a/tools/check-version-consistency.sh
+++ b/tools/check-version-consistency.sh
@@ -348,6 +348,13 @@ require_template_sha256sums(
 flake_text = read_text("flake.nix")
 if "builtins.fromTOML (builtins.readFile ./Cargo.toml)" not in flake_text:
     errors.append("flake.nix package version should be derived from Cargo.toml")
+if not all(
+    token in flake_text
+    for token in ("package.rust-version", "pkgs.rustc.version", "versionAtLeast")
+):
+    errors.append(
+        "flake.nix should compare nixpkgs rustc against Cargo.toml rust-version"
+    )
 
 # Install examples that pin a concrete tag are stale one release later.
 readme_pin_patterns = (