diff --git a/.github/buildomat/build-one.sh b/.github/buildomat/build-one.sh
index a999a36126..6ad2208f20 100755
--- a/.github/buildomat/build-one.sh
+++ b/.github/buildomat/build-one.sh
@@ -9,6 +9,7 @@ name=$1
 toml=$2
 image=$3
 
+rustup toolchain install
 cargo xtask dist $toml
 cp target/$name/dist/$image/build-$name-image-$image.zip /work/
 touch /work/this_is_not_signed.txt
diff --git a/.github/buildomat/jobs/rot.sh b/.github/buildomat/jobs/rot.sh
index e7032fab3d..f0fbf6983d 100755
--- a/.github/buildomat/jobs/rot.sh
+++ b/.github/buildomat/jobs/rot.sh
@@ -25,6 +25,7 @@ trap _cleanup SIGINT SIGTERM EXIT
 source .github/buildomat/force-git-over-https.sh
 source .github/buildomat/permslip-setup.sh
 
+rustup toolchain install
 
 cargo xtask dist app/oxide-rot-1/app-dev.toml
 $PERMSLIP_DIR/target/release/permslip --url=http://localhost:41340 \
diff --git a/.github/buildomat/permslip-setup.sh b/.github/buildomat/permslip-setup.sh
index 95833abfc7..123e357119 100644
--- a/.github/buildomat/permslip-setup.sh
+++ b/.github/buildomat/permslip-setup.sh
@@ -26,6 +26,7 @@ BART_KEY=$(pwd)/support/fake_certs/fake_private_key.pem
 mkdir -p $PERMSLIP_DIR
 git clone https://github.com/oxidecomputer/permission-slip.git -b ssh_key_fix $PERMSLIP_DIR
 pushd $PERMSLIP_DIR
+rustup toolchain install
 cargo build --release
 export POSTGRES_HOST=localhost
 export POSTGRES_PORT=5432
diff --git a/.github/workflows/build-one.yml b/.github/workflows/build-one.yml
index 90810c957a..ecfe8fc1c3 100644
--- a/.github/workflows/build-one.yml
+++ b/.github/workflows/build-one.yml
@@ -40,6 +40,7 @@ jobs:
       # install rust toolchain
       - name: Install Rust toolchain
         run: |
+          rustup show active-toolchain || rustup toolchain install
           rustup show
           rustup component add clippy