diff --git a/.anvil.lock b/.anvil.lock
index 006007753..156937fd6 100644
--- a/.anvil.lock
+++ b/.anvil.lock
@@ -1,7 +1,7 @@
 version = 1
 tool = "anvil"
 tool_version = "0.9.0"
-catalog_checksum = "sha256:8daaee8ac9a6ceb2c71b002ff6eb85d49057ae8df7c56f2c4c9a2805de3288bb"
+catalog_checksum = "sha256:96c5667686180202232be81717f977dbcd8c77805f21bbb022876c73e907944f"
 
 [[file]]
 path = ".anvil/container/Dockerfile.dockerignore"
@@ -9,7 +9,7 @@ checksum = "sha256:641cb14e197a1fd9c8e179b7e992aede15d80291841b82830d7283e1b751d
 
 [[file]]
 path = ".github/actions/anvil-impact/action.yml"
-checksum = "sha256:76be01852dc1f7e01905c4a8ad384ca57eefc15e2ed74c5c00f57dddefae9b6f"
+checksum = "sha256:9c9b4fabcaa073e9a1e8a55fbb13bdfff9017afb0520ac51b9caf90a092c9b5d"
 
 [[file]]
 path = ".github/actions/anvil-report-status/action.yml"
@@ -21,7 +21,7 @@ checksum = "sha256:d564a0ce424cda58c8f5b2476cf0c8b36e759afbdf8227608bd1f3fc74913
 
 [[file]]
 path = ".github/actions/anvil-setup/action.yml"
-checksum = "sha256:08bdc66a6ee94447aa1a60ece93c73fcbc930b7e331de85b2e9b78b5bc3d2e01"
+checksum = "sha256:26ab9d71d809c0fb80e01975de9ba4d7e00c8d289063578c190b7a411c3f7027"
 
 [[file]]
 path = ".github/actions/anvil-setup/just-problem-matcher.json"
@@ -245,7 +245,7 @@ checksum = "sha256:00453a12cbb34811ee6a2c083dade5f6198575e3b0610f49e4743366326cd
 
 [[file]]
 path = "justfiles/anvil/tools.just"
-checksum = "sha256:77329a0cb72de82742e7f48b6c8c06874e13b5c1622dc8080ce003e0c5ece251"
+checksum = "sha256:2f2f45903254f40a6510ae8163003c495e71f54e705808b7a6ac9111f82564b1"
 
 [[file]]
 path = "justfiles/anvil/versions.just"
diff --git a/.github/actions/anvil-impact/action.yml b/.github/actions/anvil-impact/action.yml
index d5f41291b..8a7b8da0d 100644
--- a/.github/actions/anvil-impact/action.yml
+++ b/.github/actions/anvil-impact/action.yml
@@ -23,17 +23,12 @@ description: |
 runs:
   using: composite
   steps:
-    # anvil-setup with group=none bootstraps the rust toolchain +
-    # just + binstall + cache, but skips the full catalog install.
-    # We follow it with just the cargo-delta install (the only tool
-    # this composite needs). This keeps the impact stage lean -- it's
+    # Install only cargo-delta inside setup, after restore and before save.
+    # This keeps the impact stage lean -- it's
     # the critical-path gating dep for every PR-tier group job.
     - uses: ./.github/actions/anvil-setup
       with:
-        group: none
-    - name: Install cargo-delta
-      shell: bash
-      run: just anvil-tool-cargo-delta-install binstall
+        group: impact
     - name: Compute impact
       shell: bash
       # Run the shared anvil-impact recipe -- the same impact building block
diff --git a/.github/actions/anvil-setup/action.yml b/.github/actions/anvil-setup/action.yml
index e9b9baff6..fc926b567 100644
--- a/.github/actions/anvil-setup/action.yml
+++ b/.github/actions/anvil-setup/action.yml
@@ -14,8 +14,8 @@ inputs:
           `just anvil-setup` -- use for local "give me everything"
           flows.
         - "none": skip tool installation entirely; just restore the
-          Cargo cache and bootstrap just + binstall. Used by
-          anvil-impact, which installs only cargo-delta afterwards.
+          Cargo cache and bootstrap just + binstall.
+        - "impact": install only cargo-delta from source, before saving the cache.
         - a name containing only lowercase letters, digits, and hyphens:
           install only that group's prerequisites via
           `just anvil-<group>-setup`.
@@ -110,6 +110,8 @@ runs:
     # cargo-binstall keeps the cold bootstrap path fast.
     - name: Install cargo-binstall
       uses: cargo-bins/cargo-binstall@v1.21.0 # pinned by tag: this release is an immutable release (GitHub locks the tag to a commit)
+      with:
+        version: "1.21.0"
 
     - name: Install just
       shell: pwsh -NoProfile -Command ". '{0}'"
@@ -122,9 +124,9 @@ runs:
         }
         if ($null -eq $installed -or $installed -lt $minimum) {
           Write-Host "Installing just >= $minimum (installed: $(if ($installed) { $installed } else { 'not found' }))"
-          & cargo binstall --no-confirm --locked --version ">=$minimum" just
+          & cargo binstall --no-confirm --locked --no-discover-github-token --version "=$minimum" just
           if ($LASTEXITCODE -ne 0) {
-            & cargo install --locked --version ">=$minimum" just
+            & cargo install --locked --version "=$minimum" just
             if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         }
@@ -148,8 +150,9 @@ runs:
         ANVIL_GROUP: ${{ inputs.group }}
       # When `group` is empty (the default), installs the full catalog
       # via `just anvil-setup binstall`. When `group` is "none",
-      # skips tool installation entirely (used by anvil-impact, which
-      # only needs cargo-delta and installs it itself afterwards). When
+      # skips tool installation entirely. The "impact" group source-installs
+      # cargo-delta before the cache save, avoiding release discovery on
+      # the impact stage's critical path. When
       # `group` is anything else, installs only what that group needs
       # via `just anvil-<group>-setup binstall`.
       #
@@ -167,6 +170,7 @@ runs:
 
         case "$ANVIL_GROUP" in
           none) echo "anvil-setup: group=none, skipping tool install" ;;
+          impact) just anvil-tool-cargo-delta-install install ;;
           "")   just anvil-setup binstall ;;
           *)    just "anvil-$ANVIL_GROUP-setup" binstall ;;
         esac
diff --git a/crates/cargo-anvil/docs/design/github.md b/crates/cargo-anvil/docs/design/github.md
index 2da4d4b24..ec266e60b 100644
--- a/crates/cargo-anvil/docs/design/github.md
+++ b/crates/cargo-anvil/docs/design/github.md
@@ -778,8 +778,11 @@ prerequisites provision the selected compiler and tools. Its
 
 - empty (default): runs `just anvil-setup binstall` -- the full catalog. Use
   for local "give me everything" flows.
-- `none`: skips the group/full tool fan-out. Used by `anvil-impact`, which only
-  needs `cargo-delta` and installs it itself afterwards.
+- `none`: skips the group/full tool fan-out.
+- `impact`: runs `just anvil-tool-cargo-delta-install install` before saving the
+  existing Cargo cache. A cold miss builds the exact catalog pin with `--locked`;
+  a warm hit reuses the installed tool. This avoids release discovery for delta
+  in the impact stage, not because delta binaries are unavailable.
 - any other value (e.g. `pr-fast`, `scheduled-advisories`): runs
   `just anvil-<group>-setup binstall` -- only the tools, components, and
   toolchains that group actually needs. Ordinary group names contain only
@@ -798,6 +801,13 @@ The action expects the rustup proxies on `PATH` and installs a missing selected
 toolchain (see §7).
 `anvil-impact` is described in §6 below.
 
+Setup does not forward `github.token` to installers. Binstall calls disable token
+discovery from GitHub CLI and Git configuration. Explicit caller credentials are
+not removed. The later run-group step retains its existing API token scope.
+Bootstrap downloads pin cargo-binstall to 1.21.0 and Just to 1.46.0; newer installed
+Just versions remain accepted. Other groups retain binary-first installation and
+the existing prerequisite-checked source fallback for spellcheck.
+
 Its optional `free-disk-space` input defaults to `false`. When enabled on a
 GitHub-hosted runner, it removes pre-installed toolchains that anvil's Rust checks do
 not use: Android, Haskell/GHC, Swift and browser drivers on Linux; Android and
@@ -813,18 +823,17 @@ Other groups retain the action's disabled default.
 `anvil-impact` recipe — the same impact building block adopters run locally (see
 [local.md §4](./local.md#4-impact-scoping-via-the-anvil-impact-recipe)). It:
 
-1. `./.github/actions/anvil-setup` with `group: none` (bootstrap rust + just +
-   cache; no catalog tools).
-2. `just anvil-tool-cargo-delta-install binstall` -- the only tool this composite
-   needs. **This is the only job that runs cargo-delta to compute the impact
+1. `./.github/actions/anvil-setup` with `group: impact` restores Cargo home,
+   bootstraps tools, and source-installs cargo-delta before the cache save.
+   **This is the only job that runs cargo-delta to compute the impact
    set.** (Group setup jobs also install cargo-delta as a prerequisite, but in
    `consume` mode they never run it -- they read the downloaded impact cache.)
-3. `just anvil-impact`, which resolves the base ref (`_anvil-base-ref`), snapshots the
+2. `just anvil-impact`, which resolves the base ref (`_anvil-base-ref`), snapshots the
    base ref (in a throwaway worktree) and the working tree, runs
    `cargo delta impact`, and writes the durable cache under `target/anvil/impact/`:
    the per-tier `include_<tier>.txt` lists (via `_anvil-impact-format`), `impact.json`,
    and the `snapshots/`.
-4. Uploads that whole directory as the `anvil-impact-<runner.os>` artifact
+3. Uploads that whole directory as the `anvil-impact-<runner.os>` artifact
    (`actions/upload-artifact`).
 
 ### 6.1 How the impact result propagates to the group jobs
diff --git a/crates/cargo-anvil/docs/design/local.md b/crates/cargo-anvil/docs/design/local.md
index eae31ad6c..916780002 100644
--- a/crates/cargo-anvil/docs/design/local.md
+++ b/crates/cargo-anvil/docs/design/local.md
@@ -229,11 +229,9 @@ catalog edit (changing a variable in `versions.just`), not an upstream-release-t
 surprise.
 
 `cargo-binstall` and `just` are bootstrap utilities rather than catalog checks.
-When absent, setup installs the latest compatible release available at that time;
-when present, setup accepts it. They are intentionally outside the catalog's exact
-installation guarantee so the bootstrap does not recursively require a versioned
-installer. Their versions can therefore vary across cold environments, while every
-tool that determines a catalog check's verdict remains catalog-controlled.
+GitHub setup pins their downloads to cargo-binstall 1.21.0 and Just 1.46.0, while
+accepting newer installed Just versions. The local cargo-binstall source bootstrap
+continues to install the latest compatible release when the binary is absent.
 
 ### 3.2 Detecting installed versions
 
@@ -308,6 +306,10 @@ The `installer` argument:
   A successful binary path cuts the cold-runner install phase from ~30 min to ~1 min.
   `cargo-binstall` itself needs to be on PATH; the GH setup composite arranges this.
 
+Binstall calls use `--no-discover-github-token` to avoid reading credentials from
+GitHub CLI or Git configuration. Explicit token environment variables and Cargo
+registry credentials are unchanged. This is not isolation from caller credentials.
+
 The GitHub composite setup action calls `just anvil-<group>-setup binstall`
 (or just `anvil-setup binstall` when no group is scoped). The ADO setup step
 template uses the default `install` backend because cargo-binstall has unresolved
diff --git a/crates/cargo-anvil/src/anvil/artifacts/github.rs b/crates/cargo-anvil/src/anvil/artifacts/github.rs
index 78433a6ab..45c62324b 100644
--- a/crates/cargo-anvil/src/anvil/artifacts/github.rs
+++ b/crates/cargo-anvil/src/anvil/artifacts/github.rs
@@ -254,6 +254,31 @@ mod tests {
         assert!(!SETUP_ACTION.contains("apt-get install -y libclang-dev"));
     }
 
+    #[test]
+    fn setup_avoids_implicit_installer_credentials_and_pins_bootstrap_downloads() {
+        for action in [SETUP_ACTION, IMPACT_ACTION] {
+            assert!(!action.contains("${{ github.token }}"));
+            assert!(!action.contains("Remove-Item Env:"));
+        }
+        let bootstrap = SETUP_ACTION
+            .split_once("    - name: Install just\n")
+            .unwrap()
+            .1
+            .split("\n    - name:")
+            .next()
+            .unwrap();
+        assert!(bootstrap.contains("cargo binstall --no-confirm --locked --no-discover-github-token --version \"=$minimum\" just"));
+        assert!(bootstrap.contains("cargo install --locked --version \"=$minimum\" just"));
+        let binstall = SETUP_ACTION
+            .split_once("    - name: Install cargo-binstall\n")
+            .unwrap()
+            .1
+            .split("\n    - name:")
+            .next()
+            .unwrap();
+        assert!(binstall.contains("version: \"1.21.0\""));
+    }
+
     #[test]
     fn run_group_action_captures_and_reports_results() {
         assert!(RUN_GROUP_ACTION.contains("uses: ./.github/actions/anvil-setup"));
@@ -416,14 +441,18 @@ export -f just
     }
 
     #[test]
-    fn impact_action_uses_group_none_and_runs_the_shared_recipe() {
-        // The impact action reuses anvil-setup (group=none) + the cargo-delta
+    fn impact_action_installs_delta_before_saving_and_runs_the_shared_recipe() {
+        // The impact action reuses anvil-setup (group=impact) for the cargo-delta
         // install, then runs the same `just anvil-impact` recipe adopters run
         // locally and uploads the whole cache as a per-OS artifact. The include
         // lists reach group jobs through that downloaded cache, never job
         // outputs, so CI and local execution stay identical by construction.
-        assert!(IMPACT_ACTION.contains("group: none"));
-        assert!(IMPACT_ACTION.contains("just anvil-tool-cargo-delta-install binstall"));
+        assert!(IMPACT_ACTION.contains("group: impact"));
+        assert!(!IMPACT_ACTION.contains("run: just anvil-tool-cargo-delta-install"));
+        let restore = SETUP_ACTION.find("    - name: Restore cargo cache").unwrap();
+        let install = SETUP_ACTION.find("impact) just anvil-tool-cargo-delta-install install").unwrap();
+        let save = SETUP_ACTION.find("    - name: Save cargo cache").unwrap();
+        assert!(restore < install && install < save);
         assert!(IMPACT_ACTION.contains("run: just anvil-impact"));
         assert!(IMPACT_ACTION.contains("uses: actions/upload-artifact"));
         assert!(IMPACT_ACTION.contains("name: anvil-impact-${{ runner.os }}"));
diff --git a/crates/cargo-anvil/templates/github/impact-action.yml b/crates/cargo-anvil/templates/github/impact-action.yml
index d5f41291b..8a7b8da0d 100644
--- a/crates/cargo-anvil/templates/github/impact-action.yml
+++ b/crates/cargo-anvil/templates/github/impact-action.yml
@@ -23,17 +23,12 @@ description: |
 runs:
   using: composite
   steps:
-    # anvil-setup with group=none bootstraps the rust toolchain +
-    # just + binstall + cache, but skips the full catalog install.
-    # We follow it with just the cargo-delta install (the only tool
-    # this composite needs). This keeps the impact stage lean -- it's
+    # Install only cargo-delta inside setup, after restore and before save.
+    # This keeps the impact stage lean -- it's
     # the critical-path gating dep for every PR-tier group job.
     - uses: ./.github/actions/anvil-setup
       with:
-        group: none
-    - name: Install cargo-delta
-      shell: bash
-      run: just anvil-tool-cargo-delta-install binstall
+        group: impact
     - name: Compute impact
       shell: bash
       # Run the shared anvil-impact recipe -- the same impact building block
diff --git a/crates/cargo-anvil/templates/github/setup-action.yml b/crates/cargo-anvil/templates/github/setup-action.yml
index e9b9baff6..fc926b567 100644
--- a/crates/cargo-anvil/templates/github/setup-action.yml
+++ b/crates/cargo-anvil/templates/github/setup-action.yml
@@ -14,8 +14,8 @@ inputs:
           `just anvil-setup` -- use for local "give me everything"
           flows.
         - "none": skip tool installation entirely; just restore the
-          Cargo cache and bootstrap just + binstall. Used by
-          anvil-impact, which installs only cargo-delta afterwards.
+          Cargo cache and bootstrap just + binstall.
+        - "impact": install only cargo-delta from source, before saving the cache.
         - a name containing only lowercase letters, digits, and hyphens:
           install only that group's prerequisites via
           `just anvil-<group>-setup`.
@@ -110,6 +110,8 @@ runs:
     # cargo-binstall keeps the cold bootstrap path fast.
     - name: Install cargo-binstall
       uses: cargo-bins/cargo-binstall@v1.21.0 # pinned by tag: this release is an immutable release (GitHub locks the tag to a commit)
+      with:
+        version: "1.21.0"
 
     - name: Install just
       shell: pwsh -NoProfile -Command ". '{0}'"
@@ -122,9 +124,9 @@ runs:
         }
         if ($null -eq $installed -or $installed -lt $minimum) {
           Write-Host "Installing just >= $minimum (installed: $(if ($installed) { $installed } else { 'not found' }))"
-          & cargo binstall --no-confirm --locked --version ">=$minimum" just
+          & cargo binstall --no-confirm --locked --no-discover-github-token --version "=$minimum" just
           if ($LASTEXITCODE -ne 0) {
-            & cargo install --locked --version ">=$minimum" just
+            & cargo install --locked --version "=$minimum" just
             if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         }
@@ -148,8 +150,9 @@ runs:
         ANVIL_GROUP: ${{ inputs.group }}
       # When `group` is empty (the default), installs the full catalog
       # via `just anvil-setup binstall`. When `group` is "none",
-      # skips tool installation entirely (used by anvil-impact, which
-      # only needs cargo-delta and installs it itself afterwards). When
+      # skips tool installation entirely. The "impact" group source-installs
+      # cargo-delta before the cache save, avoiding release discovery on
+      # the impact stage's critical path. When
       # `group` is anything else, installs only what that group needs
       # via `just anvil-<group>-setup binstall`.
       #
@@ -167,6 +170,7 @@ runs:
 
         case "$ANVIL_GROUP" in
           none) echo "anvil-setup: group=none, skipping tool install" ;;
+          impact) just anvil-tool-cargo-delta-install install ;;
           "")   just anvil-setup binstall ;;
           *)    just "anvil-$ANVIL_GROUP-setup" binstall ;;
         esac
diff --git a/crates/cargo-anvil/templates/justfiles/anvil/tools.just b/crates/cargo-anvil/templates/justfiles/anvil/tools.just
index ec0008055..4d37d0615 100644
--- a/crates/cargo-anvil/templates/justfiles/anvil/tools.just
+++ b/crates/cargo-anvil/templates/justfiles/anvil/tools.just
@@ -468,6 +468,7 @@ _install-tool-core name version installer source_prereq="":
         if ($sourcePrereq) {
             $binstallArgs += @('--disable-strategies', 'compile')
         }
+        $binstallArgs += '--no-discover-github-token'
         $binstallArgs += @($name, '--version', "=$version")
         & cargo {{_anvil_stable_toolchain_args}} @binstallArgs
         if ($LASTEXITCODE -eq 0) { exit 0 }
diff --git a/crates/cargo-anvil/tests/recipe_contracts.rs b/crates/cargo-anvil/tests/recipe_contracts.rs
index be7d85a44..d6dfbd0e0 100644
--- a/crates/cargo-anvil/tests/recipe_contracts.rs
+++ b/crates/cargo-anvil/tests/recipe_contracts.rs
@@ -394,6 +394,9 @@ _anvil-impact-include tier:
     let bin = tmp.path().join("fake-bin");
     fs::create_dir_all(&bin).unwrap();
     write(&bin.join("cargo.ps1"), FAKE_CARGO_PS1);
+    // Installer fixtures must not depend on cargo-binstall being installed on
+    // the host. Fake Cargo owns the download/fallback outcomes.
+    write(&bin.join("cargo-binstall.ps1"), "exit 0\n");
     write(&bin.join("git.ps1"), "exit 0\n");
     write(
         &bin.join("rustc.ps1"),
@@ -1741,6 +1744,75 @@ source-prereq:
         !ordinary_binstall.contains("--disable-strategies compile"),
         "tools without source prerequisites retain binstall's compile strategy"
     );
+    assert!(
+        ordinary_binstall.contains("--no-discover-github-token"),
+        "binary installation must not discover credentials from gh/git configuration"
+    );
+}
+
+#[test]
+fn binary_hit_does_not_require_source_prerequisites_or_a_host_installer() {
+    assert!(tools_available(), "real Just and PowerShell are required for installer contracts");
+    let tmp = fixture(&[("versions.just", VERSIONS), ("tools.just", TOOLS)], &[]);
+    let log = tmp.path().join("cargo.log");
+    let output = run_just(
+        tmp.path(),
+        &["_install-tool-core", "cargo-spellcheck", "0.15.7", "binstall", "must-not-run"],
+        &[
+            ("FAKE_CARGO_LOG", log.as_os_str()),
+            ("FAKE_INSTALL_LIST_OUTPUT", OsStr::new("")),
+            ("FAKE_BINSTALL_EXIT", OsStr::new("0")),
+            ("FAKE_INSTALL_EXIT", OsStr::new("23")),
+        ],
+    );
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    let calls = fs::read_to_string(log).unwrap();
+    assert!(calls.contains("binstall --no-confirm --locked --disable-strategies compile --no-discover-github-token"));
+    assert!(!calls.contains("install --locked"));
+}
+
+#[test]
+fn pinned_installer_choices_reuse_warm_cargo_metadata() {
+    assert!(tools_available(), "real Just and PowerShell are required for installer contracts");
+    for installer in ["install", "binstall"] {
+        for installed in ["", "1.2.3", "1.3.0", "1.2.2"] {
+            let tmp = fixture(
+                &[("versions.just", VERSIONS), ("tools.just", TOOLS)],
+                &["anvil-toolchain-stable-install"],
+            );
+            write(&tmp.path().join("rust-toolchain.toml"), "[toolchain]\nchannel = \"1.97\"\n");
+            let log = tmp.path().join("cargo.log");
+            let ledger = if installed.is_empty() {
+                String::new()
+            } else {
+                format!("cargo-fixture v{installed}:")
+            };
+            let output = run_just(
+                tmp.path(),
+                &["_install-tool", "cargo-fixture", "1.2.3", installer],
+                &[
+                    ("FAKE_CARGO_LOG", log.as_os_str()),
+                    ("FAKE_INSTALL_LIST_OUTPUT", OsStr::new(&ledger)),
+                    ("FAKE_INSTALL_LIST_EXIT", OsStr::new("0")),
+                    ("FAKE_BINSTALL_EXIT", OsStr::new("0")),
+                    ("FAKE_INSTALL_EXIT", OsStr::new("0")),
+                    ("RUSTUP_TOOLCHAIN", OsStr::new("")),
+                    ("ANVIL_MSRV_TOOLCHAIN", OsStr::new("")),
+                ],
+            );
+            assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+            let calls = fs::read_to_string(log).unwrap();
+            if installed == "1.2.3" || installed == "1.3.0" {
+                assert_eq!(calls.trim(), "install --list", "warm metadata must avoid either installer");
+            } else if installer == "install" {
+                assert!(calls.contains("install --locked cargo-fixture --version =1.2.3"));
+                assert!(!calls.contains("binstall"));
+            } else {
+                assert!(calls.contains("binstall --no-confirm --locked --no-discover-github-token cargo-fixture --version =1.2.3"));
+                assert!(!calls.contains("install --locked cargo-fixture"));
+            }
+        }
+    }
 }
 
 #[test]
diff --git a/crates/cargo-anvil/tests/snapshots/snapshots__ado_backend.snap b/crates/cargo-anvil/tests/snapshots/snapshots__ado_backend.snap
index db2a3abec..fee2e67f7 100644
--- a/crates/cargo-anvil/tests/snapshots/snapshots__ado_backend.snap
+++ b/crates/cargo-anvil/tests/snapshots/snapshots__ado_backend.snap
@@ -7406,6 +7406,7 @@ _install-tool-core name version installer source_prereq="":
         if ($sourcePrereq) {
             $binstallArgs += @('--disable-strategies', 'compile')
         }
+        $binstallArgs += '--no-discover-github-token'
         $binstallArgs += @($name, '--version', "=$version")
         & cargo {{_anvil_stable_toolchain_args}} @binstallArgs
         if ($LASTEXITCODE -eq 0) { exit 0 }
diff --git a/crates/cargo-anvil/tests/snapshots/snapshots__github_backend.snap b/crates/cargo-anvil/tests/snapshots/snapshots__github_backend.snap
index 41071d4bc..a9f8eb1bc 100644
--- a/crates/cargo-anvil/tests/snapshots/snapshots__github_backend.snap
+++ b/crates/cargo-anvil/tests/snapshots/snapshots__github_backend.snap
@@ -262,17 +262,12 @@ description: |
 runs:
   using: composite
   steps:
-    # anvil-setup with group=none bootstraps the rust toolchain +
-    # just + binstall + cache, but skips the full catalog install.
-    # We follow it with just the cargo-delta install (the only tool
-    # this composite needs). This keeps the impact stage lean -- it's
+    # Install only cargo-delta inside setup, after restore and before save.
+    # This keeps the impact stage lean -- it's
     # the critical-path gating dep for every PR-tier group job.
     - uses: ./.github/actions/anvil-setup
       with:
-        group: none
-    - name: Install cargo-delta
-      shell: bash
-      run: just anvil-tool-cargo-delta-install binstall
+        group: impact
     - name: Compute impact
       shell: bash
       # Run the shared anvil-impact recipe -- the same impact building block
@@ -547,8 +542,8 @@ inputs:
           `just anvil-setup` -- use for local "give me everything"
           flows.
         - "none": skip tool installation entirely; just restore the
-          Cargo cache and bootstrap just + binstall. Used by
-          anvil-impact, which installs only cargo-delta afterwards.
+          Cargo cache and bootstrap just + binstall.
+        - "impact": install only cargo-delta from source, before saving the cache.
         - a name containing only lowercase letters, digits, and hyphens:
           install only that group's prerequisites via
           `just anvil-<group>-setup`.
@@ -643,6 +638,8 @@ runs:
     # cargo-binstall keeps the cold bootstrap path fast.
     - name: Install cargo-binstall
       uses: cargo-bins/cargo-binstall@v1.21.0 # pinned by tag: this release is an immutable release (GitHub locks the tag to a commit)
+      with:
+        version: "1.21.0"
 
     - name: Install just
       shell: pwsh -NoProfile -Command ". '{0}'"
@@ -655,9 +652,9 @@ runs:
         }
         if ($null -eq $installed -or $installed -lt $minimum) {
           Write-Host "Installing just >= $minimum (installed: $(if ($installed) { $installed } else { 'not found' }))"
-          & cargo binstall --no-confirm --locked --version ">=$minimum" just
+          & cargo binstall --no-confirm --locked --no-discover-github-token --version "=$minimum" just
           if ($LASTEXITCODE -ne 0) {
-            & cargo install --locked --version ">=$minimum" just
+            & cargo install --locked --version "=$minimum" just
             if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
         }
@@ -681,8 +678,9 @@ runs:
         ANVIL_GROUP: ${{ inputs.group }}
       # When `group` is empty (the default), installs the full catalog
       # via `just anvil-setup binstall`. When `group` is "none",
-      # skips tool installation entirely (used by anvil-impact, which
-      # only needs cargo-delta and installs it itself afterwards). When
+      # skips tool installation entirely. The "impact" group source-installs
+      # cargo-delta before the cache save, avoiding release discovery on
+      # the impact stage's critical path. When
       # `group` is anything else, installs only what that group needs
       # via `just anvil-<group>-setup binstall`.
       #
@@ -700,6 +698,7 @@ runs:
 
         case "$ANVIL_GROUP" in
           none) echo "anvil-setup: group=none, skipping tool install" ;;
+          impact) just anvil-tool-cargo-delta-install install ;;
           "")   just anvil-setup binstall ;;
           *)    just "anvil-$ANVIL_GROUP-setup" binstall ;;
         esac
@@ -7548,6 +7547,7 @@ _install-tool-core name version installer source_prereq="":
         if ($sourcePrereq) {
             $binstallArgs += @('--disable-strategies', 'compile')
         }
+        $binstallArgs += '--no-discover-github-token'
         $binstallArgs += @($name, '--version', "=$version")
         & cargo {{_anvil_stable_toolchain_args}} @binstallArgs
         if ($LASTEXITCODE -eq 0) { exit 0 }
diff --git a/crates/cargo-anvil/tests/snapshots/snapshots__local_only.snap b/crates/cargo-anvil/tests/snapshots/snapshots__local_only.snap
index e19faf5b9..72f35f642 100644
--- a/crates/cargo-anvil/tests/snapshots/snapshots__local_only.snap
+++ b/crates/cargo-anvil/tests/snapshots/snapshots__local_only.snap
@@ -6232,6 +6232,7 @@ _install-tool-core name version installer source_prereq="":
         if ($sourcePrereq) {
             $binstallArgs += @('--disable-strategies', 'compile')
         }
+        $binstallArgs += '--no-discover-github-token'
         $binstallArgs += @($name, '--version', "=$version")
         & cargo {{_anvil_stable_toolchain_args}} @binstallArgs
         if ($LASTEXITCODE -eq 0) { exit 0 }
diff --git a/justfiles/anvil/tools.just b/justfiles/anvil/tools.just
index ec0008055..4d37d0615 100644
--- a/justfiles/anvil/tools.just
+++ b/justfiles/anvil/tools.just
@@ -468,6 +468,7 @@ _install-tool-core name version installer source_prereq="":
         if ($sourcePrereq) {
             $binstallArgs += @('--disable-strategies', 'compile')
         }
+        $binstallArgs += '--no-discover-github-token'
         $binstallArgs += @($name, '--version', "=$version")
         & cargo {{_anvil_stable_toolchain_args}} @binstallArgs
         if ($LASTEXITCODE -eq 0) { exit 0 }