diff --git a/.cargo/config.toml b/.cargo/config.toml
index 671ea88..4486c9c 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -6,20 +6,28 @@
 # The UEFI flags reproduce the measured binaries byte-for-byte (stage0.efi, ena.efi, test-payload);
 # do not change them without re-pinning PCR4/PCR14 expectations. No `[build] target`: every stage0
 # build passes an explicit `--target`.
+#
+# --remap-path-prefix rewrites the embedded dep source paths to a fixed prefix so the build does not
+# depend on where CARGO_HOME is (CI uses /tmp/.cargo, local uses /src/.cargo); this is what makes CI
+# and local builds byte-identical. trim-paths would be cleaner but is still nightly-only on 1.91.
+# The last remap handles rust-src: if it is installed (rust-analyzer does this locally; CI's fresh
+# toolchain has not), rustc emits std panic-location paths from the sysroot instead of the baked
+# /rustc/<hash>, so we remap the sysroot rust-src path to that same /rustc/<hash>. UPDATE THE HASH
+# when bumping the toolchain (rustc -Vv commit-hash); a stale value silently no-ops (CI==local catches it).
 
 [target.x86_64-unknown-linux-musl]
 # Fully static musl for the host-side signer (stage0-sign); rust-lld, no system cc.
-rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"]
+rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"]
 
 [target.aarch64-unknown-linux-musl]
-rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"]
+rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"]
 
 [target.x86_64-unknown-uefi]
 # The measured bootloader + payloads. Static, rust-lld.
-rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"]
+rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"]
 
 [target.aarch64-unknown-uefi]
-rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static"]
+rustflags = ["-C", "linker=rust-lld", "-C", "target-feature=+crt-static", "-C", "link-arg=-static", "--remap-path-prefix=/src/.cargo=/cargo", "--remap-path-prefix=/tmp/.cargo=/cargo", "--remap-path-prefix=/src/.rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust=/rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb"]
 
 # Host target for proc-macros and build scripts: rust-lld only (no crt-static), so they link with no
 # system cc. Kept out of the shared workspace config because the gnu-host repos link C and need cc.