What is your threat model that isn't solved by some combination of a rust-toolchain file and using your package manager (nix or whatever) to install rustup? If

What is your threat model that isn't solved by some combination of a rust-toolchain file and using your package manager (nix or whatever) to install rustup? If you want to isolate your build machines from the internet entirely, you're either going to use a hermetic build system and have some equivalent of vendoring your compiler, or manage your own internal package repository in which case you can just add your own Rust + Cargo build to it. If you're paranoid about building the Rust compiler from source, you can even put in the effort into bootstrapping your own lineage. But given that you're ok relying on your package manager for Haskell, it seems like this isn't a huge problem for you.