diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml
new file mode 100644
index 0000000..4c721f5
--- /dev/null
+++ b/.github/actions/setup-rust/action.yml
@@ -0,0 +1,10 @@
+name: Rust toolchain and cache setup
+description: Install Rust toolchain from rust-toolchain.toml and configure dependency caching
+
+runs:
+  using: composite
+  steps:
+    - name: Install Rust toolchain
+      run: rustup toolchain install --no-self-update
+      shell: bash
+    - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cb83ff3..285785d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,14 +25,8 @@ jobs:
             libseat-dev libgbm-dev libegl1-mesa-dev libgles2-mesa-dev \
             libdrm-dev libsystemd-dev libgtk-4-dev
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537
-        with:
-          toolchain: "1.93.1"
-          components: rustfmt, clippy
-
-      - name: Cache cargo registry and build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust
 
       - name: Check formatting
         run: cargo fmt --all --check
@@ -49,6 +43,12 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny@0.19.9 --locked
+
       # No deny.toml is committed yet, so cargo-deny runs with its built-in
       # defaults. The license check is intentionally omitted because it needs an
       # explicit allow-list to be meaningful; advisories/bans/sources are useful
@@ -56,9 +56,4 @@ jobs:
       # only hits are transitive dependencies with no safe upgrade available;
       # genuine vulnerabilities/unsound advisories still fail the job.
       - name: cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
-        with:
-          rust-version: 1.93.1
-          command: check advisories bans sources
-          command-arguments: "--warn unmaintained"
-
+        run: cargo deny check advisories bans sources --warn unmaintained