diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d3df43..c392e94 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -141,9 +141,13 @@ jobs:
           name: build-scripts
           path: scripts/build/
 
+      - name: Set up Rust
+        if: steps.format.outputs.format == 'star'
+        uses: dtolnay/rust-toolchain@stable
+
       - name: Install starlight
         if: steps.format.outputs.format == 'star'
-        run: npm install -g @steambrew/starlight@${{ vars.STARLIGHT_VERSION }}
+        run: bash ./scripts/build/install-starlight.sh
 
       - name: Install pnpm
         if: steps.format.outputs.format != 'star'
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 4fffe55..d621a2e 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -131,9 +131,13 @@ jobs:
         with:
           node-version: "20"
 
+      - name: Set up Rust
+        if: steps.format.outputs.format == 'star'
+        uses: dtolnay/rust-toolchain@stable
+
       - name: Install starlight
         if: steps.format.outputs.format == 'star'
-        run: npm install -g @steambrew/starlight@${{ vars.STARLIGHT_VERSION }}
+        run: bash ./scripts/build/install-starlight.sh
 
       - name: Install pnpm
         if: steps.format.outputs.format != 'star'
diff --git a/scripts/build/install-starlight.sh b/scripts/build/install-starlight.sh
new file mode 100644
index 0000000..08b8edf
--- /dev/null
+++ b/scripts/build/install-starlight.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+
+# npm 1.1.6 predates source-commit metadata and the sign command.
+# Keep PR builds and production signing on the same immutable compiler source.
+cargo install starlight --locked \
+  --git https://github.com/SteamClientHomebrew/Millennium.git \
+  --rev d6a7822a43744b6290a0e059bdd032d9b9a2ec94 \
+  --root "$RUNNER_TEMP/starlight"
+
+echo "$RUNNER_TEMP/starlight/bin" >> "$GITHUB_PATH"