diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cf34edb..0fb604f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -17,7 +17,7 @@ on:
 permissions: {}
 
 env:
-  RUST_VERSION: "1.85.1"
+  RUST_VERSION: "1.87.0"
   CMAKE_VERSION: "3.27.9"
 
 jobs:
@@ -31,7 +31,7 @@ jobs:
             base: ubuntu-24.04
             image: ghcr.io/datadog/images-rb/engines/ruby:4.0-centos-gcc
             rust_target: x86_64-unknown-linux-gnu
-            rust_sha256: b7202563a52b47f575b284a5a4794fafd688e39bfe8fd855b5e80129e671cb7f
+            rust_sha256: 1f6f18ce19387c42968a474cf175e67f99280614ded9c752d5d2e37af3204bcd
             cmake_arch: x86_64
             cmake_sha256: 72b01478eeb312bf1a0136208957784fe55a7b587f8d9f9142a7fc9b0b9e9a28
           - ruby_platform: x86_64-linux-musl
@@ -41,7 +41,7 @@ jobs:
             base: ubuntu-24.04-arm
             image: ghcr.io/datadog/images-rb/engines/ruby:4.0-centos-gcc
             rust_target: aarch64-unknown-linux-gnu
-            rust_sha256: d2609d8cd965060f0b4a8c509131066369e8d3d31a92fedce177b42b32af6b4d
+            rust_sha256: 2c66e31d774a0dcd4422db74584ebc6362ff3ae90c452caff9d2fb912c821e8d
             cmake_arch: aarch64
             cmake_sha256: 11bf3d30697df465cdf43664a9473a586f010c528376a966fd310a3a22082461
           - ruby_platform: aarch64-linux-musl
@@ -129,7 +129,7 @@ jobs:
           - ruby_platform: arm64-darwin
             base: macos-15
             rust_target: aarch64-apple-darwin
-            rust_sha256: 64b0341a47e684d648c9b7defd0b7ff9d5397a64718cf803c1e114544f94bbe9
+            rust_sha256: 249496972e6f845f052036b9d7e73f816418412de2b266ec717b9050c1810dc3
     name: Build (${{ matrix.platform.ruby_platform }})
     runs-on: ${{ matrix.platform.base }}
     steps:
diff --git a/Rakefile b/Rakefile
index 0d7988e..5e1eb32 100644
--- a/Rakefile
+++ b/Rakefile
@@ -22,27 +22,27 @@ end
 LIB_GITHUB_RELEASES = [
   {
     file: "libdatadog-aarch64-alpine-linux-musl.tar.gz",
-    sha256: "13936a53cf9baeecd91326eb6a2e0af0cb279aabfd37669680b011e185ec9766",
+    sha256: "d95b24f1f7c46ab4b488a4802bb17b30db133b284079b96028d4cccc08b098d1",
     ruby_platform: "aarch64-linux-musl"
   },
   {
     file: "libdatadog-aarch64-unknown-linux-gnu.tar.gz",
-    sha256: "135abde5bb6638ea54abf858bbff51a6f90fa3c3886da975754ae9bfaff79e83",
+    sha256: "662b760cc1db173737991e62e400c104eb776dd01309b8669760f6d9e7471f2e",
     ruby_platform: "aarch64-linux"
   },
   {
     file: "libdatadog-x86_64-alpine-linux-musl.tar.gz",
-    sha256: "fc96026961b4f4712142fc9ca0c3aa05ca77c1e2218b8409a9738c32530b8473",
+    sha256: "232c6704c6d11116a22f379629c462cd637f36003242e98d56f1bb691639e1a9",
     ruby_platform: "x86_64-linux-musl"
   },
   {
     file: "libdatadog-x86_64-unknown-linux-gnu.tar.gz",
-    sha256: "b92bea5a650152427e71bfdf07b087b0be161a3de30b8e84edcbf64c4aee9b67",
+    sha256: "26ea0fb1f36ed2e56afbc37e6e13853c6e3de4bba48c19d7cfb6ee85cc4eaa35",
     ruby_platform: "x86_64-linux"
   },
   {
     file: "libdatadog-aarch64-apple-darwin.tar.gz",
-    sha256: "90fd2d95df78425522cf3a688d2336d99fe4b5d8a3502a2d5f042a09a06deb71",
+    sha256: "c7e24151466daa085a1b6d2a382ce135ca905bc1d7230fb983b042d3d6e615b7",
     ruby_platform: "arm64-darwin"
   }
 ]
diff --git a/flake.lock b/flake.lock
index 07e3069..2296f13 100644
--- a/flake.lock
+++ b/flake.lock
@@ -52,7 +52,28 @@
       "inputs": {
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781580018,
+        "narHash": "sha256-BlTedbM77FmesD2ZqR73vhFy+y77UrhefV7IYw1pDsk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "8bceba21a1ebea535c27c4dc723a0d5a4db9e386",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index f85d368..f21e0f6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,16 +7,30 @@
 
     # backwards compatibility with nix-build and nix-shell
     flake-compat.url = "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz";
+
+    # pinned, exact upstream Rust toolchains
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, flake-utils, flake-compat }:
+  outputs = { self, nixpkgs, flake-utils, flake-compat, rust-overlay }:
     # resolve for all platforms in turn
     flake-utils.lib.eachDefaultSystem (system:
       let
         basename = "libdatadog-rb";
 
-        # packages for this system platform
-        pkgs = nixpkgs.legacyPackages.${system};
+        # packages for this system platform, with the rust-overlay applied
+        pkgs = import nixpkgs {
+          inherit system;
+          overlays = [ (import rust-overlay) ];
+        };
+
+        # pinned Rust toolchain for building libdatadog from source; single
+        # source of truth is ./rust-toolchain.toml (kept in sync with the
+        # libdatadog toolchain and the CI `RUST_VERSION`).
+        rust = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
 
         hook = ''
           # get major.minor.0 ruby version
@@ -39,9 +53,8 @@
           pkgs.libyaml.dev  # for gem: psych
           pkgs.libffi.dev   # for gem: fiddle, ffi
 
-          # for compiling libdatadog
-          pkgs.rustc
-          pkgs.cargo
+          # for compiling libdatadog (rustc + cargo, pinned)
+          rust
           pkgs.cmake
           pkgs.autoconf
           pkgs.automake
diff --git a/lib/libdatadog/version.rb b/lib/libdatadog/version.rb
index f9562d5..ce5e608 100644
--- a/lib/libdatadog/version.rb
+++ b/lib/libdatadog/version.rb
@@ -2,7 +2,7 @@
 
 module Libdatadog
   # Current libdatadog version
-  LIB_VERSION = "33.0.0"
+  LIB_VERSION = "35.0.0"
 
   GEM_MAJOR_VERSION = "1"
   GEM_MINOR_VERSION = "0"
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..199d2a3
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,6 @@
+[toolchain]
+# Rust toolchain used to build libdatadog from source. Keep the channel in sync
+# with the libdatadog `rust-toolchain.toml` for the LIB_VERSION being packaged
+# and with the CI `RUST_VERSION` in .github/workflows/build.yml.
+channel = "1.87.0"
+profile = "minimal"