diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 199429a5..1f6dab3a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,6 +62,7 @@ oci-image:x86_64-unknown-linux-gnu:
 
 debian:x86_64-unknown-linux-gnu:
   stage: artifacts
+  # See also `rust-toolchain.toml`
   image: rust:1.70.0
   script:
     - apt-get update && apt-get install -y --no-install-recommends libclang-dev
diff --git a/Cargo.toml b/Cargo.toml
index a35cf233..40919599 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,12 +9,7 @@ readme = "README.md"
 version = "0.7.0-alpha"
 edition = "2021"
 
-# When changing this, make sure to update the hash near the text "THE
-# rust-version HASH" in `flake.nix`. If you don't have Nix installed or
-# otherwise don't know how to do this, ping `@charles:computer.surgery` or
-# `@dusk:gaze.systems` in the matrix room.
-#
-# Also make sure to update the docker image tags in `.gitlab-ci.yml`.
+# See also `rust-toolchain.toml`
 rust-version = "1.70.0"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
diff --git a/flake.nix b/flake.nix
index 76f8bb25..89a4eb43 100644
--- a/flake.nix
+++ b/flake.nix
@@ -32,33 +32,15 @@
       cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
 
       # The Rust toolchain to use
-      toolchain = fenix.packages.${system}.toolchainOf {
-        # Use the Rust version defined in `Cargo.toml`
-        channel = cargoToml.package.rust-version;
+      toolchain = fenix.packages.${system}.fromToolchainFile {
+        file = ./rust-toolchain.toml;
 
-        # THE rust-version HASH
+        # See also `rust-toolchain.toml`
         sha256 = "sha256-gdYqng0y9iHYzYPAdkC/ka3DRny3La/S5G8ASj0Ayyc=";
       };
 
-      mkToolchain = fenix.packages.${system}.combine;
-
-      buildToolchain = mkToolchain (with toolchain; [
-        cargo
-        rustc
-      ]);
-
-      devToolchain = mkToolchain (with toolchain; [
-        cargo
-        clippy
-        rust-src
-        rustc
-
-        # Always use nightly rustfmt because most of its options are unstable
-        fenix.packages.${system}.latest.rustfmt
-      ]);
-
       builder = pkgs:
-        ((crane.mkLib pkgs).overrideToolchain buildToolchain).buildPackage;
+        ((crane.mkLib pkgs).overrideToolchain toolchain).buildPackage;
 
       nativeBuildInputs = pkgs: [
         pkgs.rustPlatform.bindgenHook
@@ -114,12 +96,18 @@
           # Rust Analyzer needs to be able to find the path to default crate
           # sources, and it can read this environment variable to do so. The
           # `rust-src` component is required in order for this to work.
-          RUST_SRC_PATH = "${devToolchain}/lib/rustlib/src/rust/library";
+          RUST_SRC_PATH = "${toolchain}/lib/rustlib/src/rust/library";
         };
 
         # Development tools
         nativeBuildInputs = nativeBuildInputs pkgsHost ++ [
-          devToolchain
+          # Always use nightly rustfmt because most of its options are unstable
+          #
+          # This needs to come before `toolchain` in this list, otherwise
+          # `$PATH` will have stable rustfmt instead.
+          fenix.packages.${system}.latest.rustfmt
+
+          toolchain
         ] ++ (with pkgsHost; [
           engage
         ]);
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 00000000..cc3e2545
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,17 @@
+# This is the authoritiative configuration of this project's Rust toolchain.
+#
+# Other files that need upkeep when this changes:
+#
+# * `.gitlab-ci.yml`
+# * `Cargo.toml`
+# * `flake.nix`
+#
+# Search in those files for `rust-toolchain.toml` to find the relevant places.
+# If you're having trouble making the relevant changes, bug a maintainer.
+
+[toolchain]
+channel = "1.70.0"
+components = [
+    # For rust-analyzer
+    "rust-src",
+]