diff --git a/services/sandbox/Dockerfile b/services/sandbox/Dockerfile
index 3505012c1..2d41fff46 100644
--- a/services/sandbox/Dockerfile
+++ b/services/sandbox/Dockerfile
@@ -270,7 +270,7 @@ RUN --mount=type=cache,target=/home/agent/.cargo/registry,uid=1001,gid=1001,shar
     --mount=type=cache,target=/home/agent/.cargo/git,uid=1001,gid=1001,sharing=locked \
     --mount=type=cache,target=/home/agent/.cache/harness-server-target,uid=1001,gid=1001,sharing=locked \
     CARGO_TARGET_DIR=/home/agent/.cache/harness-server-target \
-    cargo install --locked --path /opt/centaur/harness-server-src --root /home/agent/.local
+    cargo +stable install --locked --path /opt/centaur/harness-server-src --root /home/agent/.local
 
 # No RUN instructions after these — all repo-local content at the very end.
 COPY --link --chown=1001:1001 .agents/skills/ /home/agent/.agents/skills/
diff --git a/services/sandbox/test_runtime_version_floors.py b/services/sandbox/test_runtime_version_floors.py
index 136fe91cd..4edaceb84 100644
--- a/services/sandbox/test_runtime_version_floors.py
+++ b/services/sandbox/test_runtime_version_floors.py
@@ -49,6 +49,15 @@ def test_sandbox_keeps_cross_architecture_development_tools() -> None:
         assert required in source
 
 
+def test_harness_server_build_uses_stable_rust() -> None:
+    source = DOCKERFILE.read_text(encoding="utf-8")
+
+    assert (
+        "cargo +stable install --locked --path /opt/centaur/harness-server-src "
+        "--root /home/agent/.local"
+    ) in source
+
+
 def test_node_tools_opt_in_to_the_sandbox_proxy_without_dropping_options() -> None:
     source = ENTRYPOINT.read_text(encoding="utf-8")