diff --git a/constants.env b/constants.env
index 74568a1fc..a418f90cc 100644
--- a/constants.env
+++ b/constants.env
@@ -7,8 +7,8 @@
 
 # used for testing, ensures the MSRV promise is kept; must match Cargo.toml [workspace.package].rust-version
 RUST_MSRV=1.93
-# used for static analysis & mutation testing; must match rust-toolchain.toml
-RUST_LATEST=1.96
+# used for static analysis & mutation testing
+RUST_LATEST=1.96.1
 # used for coverage and extended analysis; update on a regular basis
 RUST_NIGHTLY=nightly-2026-05-30
 # used for external type exposure checks; update alongside updates to cargo-check-external-types
diff --git a/scripts/update_rust_toolchain.ps1 b/scripts/update_rust_toolchain.ps1
index 95f0e05d0..d87a7f045 100644
--- a/scripts/update_rust_toolchain.ps1
+++ b/scripts/update_rust_toolchain.ps1
@@ -56,13 +56,11 @@ function Get-LatestStableRustVersion {
             throw "No stable release found"
         }
 
-        # Extract major.minor version (e.g., "1.92.0" -> "1.92")
-        if ($stableRelease.tag_name -match '^(\d+\.\d+)\.\d+$') {
-            $version = $Matches[1]
+        # Keep the full x.y.z version (e.g., "1.92.0") so the pinned Cargo bugfix patch is preserved
+        if ($stableRelease.tag_name -match '^\d+\.\d+\.\d+$') {
             return @{
                 Success = $true
-                Version = $version
-                FullVersion = $stableRelease.tag_name
+                Version = $stableRelease.tag_name
             }
         }
         else {
@@ -184,7 +182,7 @@ Write-Host "  RUST_NIGHTLY_EXTERNAL_TYPES: $currentRustNightlyExternal"
 Write-Host ""
 
 Write-Host "New versions:"
-Write-Host "  RUST_LATEST                : $newStableVersion (full: $($stableResult.FullVersion))"
+Write-Host "  RUST_LATEST                : $newStableVersion"
 Write-Host "  RUST_NIGHTLY               : $yesterdayNightly"
 
 if ($externalTypesResult.Success) {