diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a385f5c6..7b34b44f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,8 +27,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
 
-    # Always pull the published builder image. Rebuilding it here downloads
-    # autoconf/automake from ftpmirror.gnu.org, which is unreliable on GHA.
-    # Konflux builds the real image; denylist coverage is the job above.
+    # Always pull the published builder image rather than rebuilding it here:
+    # Konflux builds the real image, and denylist coverage is the job above.
     - name: Run test suite (pull published builder image)
       run: ./tests/test-build-wheels.sh --skip-build
diff --git a/builder/Containerfile b/builder/Containerfile
index c1f1baef..d2a30441 100644
--- a/builder/Containerfile
+++ b/builder/Containerfile
@@ -59,21 +59,21 @@ COPY build_scripts/install-autoconf.sh /opt/_internal/build_scripts/
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
     export AUTOCONF_ROOT=autoconf-2.72 && \
     export AUTOCONF_HASH=afb181a76e1ee72832f6581c0eddf8df032b83e2e0239ef79ebedc4467d92d6e && \
-    export AUTOCONF_DOWNLOAD_URL=https://ftpmirror.gnu.org/gnu/autoconf && \
+    export AUTOCONF_DOWNLOAD_URL=https://ftp.gnu.org/gnu/autoconf && \
     /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/install-autoconf.sh
 
 COPY build_scripts/install-automake.sh /opt/_internal/build_scripts/
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
     export AUTOMAKE_ROOT=automake-1.18.1 && \
     export AUTOMAKE_HASH=63e585246d0fc8772dffdee0724f2f988146d1a3f1c756a3dc5cfbefa3c01915 && \
-    export AUTOMAKE_DOWNLOAD_URL=https://ftpmirror.gnu.org/gnu/automake && \
+    export AUTOMAKE_DOWNLOAD_URL=https://ftp.gnu.org/gnu/automake && \
     /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/install-automake.sh
 
 COPY build_scripts/install-libtool.sh /opt/_internal/build_scripts/
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
     export LIBTOOL_ROOT=libtool-2.5.4 && \
     export LIBTOOL_HASH=da8ebb2ce4dcf46b90098daf962cffa68f4b4f62ea60f798d0ef12929ede6adf && \
-    export LIBTOOL_DOWNLOAD_URL=https://ftpmirror.gnu.org/gnu/libtool && \
+    export LIBTOOL_DOWNLOAD_URL=https://ftp.gnu.org/gnu/libtool && \
     /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/install-libtool.sh
 
 COPY build_scripts/install-libxcrypt.sh /opt/_internal/build_scripts/
@@ -144,10 +144,13 @@ RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
 
 FROM build_base AS build_rust
 COPY build_scripts/build-rust.sh /opt/_internal/build_scripts/
+# The unversioned .../rustup/dist path always serves the newest rustup, so the
+# version is pinned in the URL; otherwise RUSTUP_HASH breaks on every release.
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
-    export RUST_VERSION=1.95.0 && \
-    export RUST_HASH=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10 && \
-    export RUST_DOWNLOAD_URL=https://static.rust-lang.org/rustup/dist && \
+    export RUST_VERSION=1.98.1 && \
+    export RUSTUP_VERSION=1.29.1 && \
+    export RUSTUP_HASH=dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 && \
+    export RUSTUP_DOWNLOAD_URL=https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION} && \
     /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-rust.sh
 
 
diff --git a/builder/VERSION_UPDATES.md b/builder/VERSION_UPDATES.md
index b17a0972..43029a79 100644
--- a/builder/VERSION_UPDATES.md
+++ b/builder/VERSION_UPDATES.md
@@ -40,7 +40,7 @@
 ```bash
 # Rust 1.94.0 (rustup-init for x86_64)
 RUST_VERSION=1.94.0
-RUST_HASH=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10
+RUSTUP_HASH=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10
 
 # libjpeg-turbo 3.1.3
 LIBJPEG_TURBO_VERSION=3.1.3
diff --git a/builder/build_scripts/build-rust.sh b/builder/build_scripts/build-rust.sh
index 2c2f813d..c2e966b6 100755
--- a/builder/build_scripts/build-rust.sh
+++ b/builder/build_scripts/build-rust.sh
@@ -13,8 +13,8 @@ source "${MY_DIR}/build_utils.sh"
 
 # Install a more recent Rust
 check_var "${RUST_VERSION}"
-check_var "${RUST_HASH}"
-check_var "${RUST_DOWNLOAD_URL}"
+check_var "${RUSTUP_HASH}"
+check_var "${RUSTUP_DOWNLOAD_URL}"
 
 PREFIX=/opt/_internal/rust-${RUST_VERSION}
 
@@ -33,8 +33,8 @@ else
     exit 1
 fi
 
-fetch_source "${RUSTUP_INIT}" "${RUST_DOWNLOAD_URL}/${RUSTUP_ARCH}"
-check_sha256sum "${RUSTUP_INIT}" "${RUST_HASH}"
+fetch_source "${RUSTUP_INIT}" "${RUSTUP_DOWNLOAD_URL}/${RUSTUP_ARCH}"
+check_sha256sum "${RUSTUP_INIT}" "${RUSTUP_HASH}"
 chmod +x "${RUSTUP_INIT}"
 
 # Install Rust using rustup to PREFIX