diff --git a/.tangled/workflows/test.yaml b/.tangled/workflows/test.yaml
new file mode 100644
index 0000000..f94bdec
--- /dev/null
+++ b/.tangled/workflows/test.yaml
@@ -0,0 +1,21 @@
+when:
+  - event:
+      - push
+    branch:
+      - main
+
+engine: nixery
+
+dependencies:
+  nixpkgs:
+    - cargo
+    - clang
+    - openssl
+    - pkg-config
+
+steps:
+  - name: Run unit tests
+    command: |
+      export PKG_CONFIG_PATH="${PKG_CONFIG_PATH:+$PKG_CONFIG_PATH:}$(nix build nixpkgs#openssl.dev --no-link --print-out-paths)/lib/pkgconfig"
+      cargo test --workspace
+
diff --git a/Cargo.toml b/Cargo.toml
index 8218ee3..a091646 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,6 +10,7 @@ repository = "https://tangled.org/@tjh.dev/gordian"
 license = "MIT or Apache-2.0"
 edition = "2024"
 publish = false
+rust-version = "1.86"
 
 [workspace.dependencies]
 identity = { path = "crates/identity" }
diff --git a/crates/identity/src/resolvers.rs b/crates/identity/src/resolvers.rs
index 419723c..08e4670 100644
--- a/crates/identity/src/resolvers.rs
+++ b/crates/identity/src/resolvers.rs
@@ -197,18 +197,18 @@ where
                 continue;
             };
 
-            if let Some(old_did) = resolved_did.replace(did.clone())
-                && old_did != did
-            {
-                tracing::error!(
-                    ?handle,
-                    ?did,
-                    ?old_did,
-                    "multiple conflicting DIDs found for handle"
-                );
-                // @TODO Replace this with an error so we can retry with a
-                // recursive dns resolver.
-                return Ok(None);
+            if let Some(old_did) = resolved_did.replace(did.clone()) {
+                if old_did != did {
+                    tracing::error!(
+                        ?handle,
+                        ?did,
+                        ?old_did,
+                        "multiple conflicting DIDs found for handle"
+                    );
+                    // @TODO Replace this with an error so we can retry with a
+                    // recursive dns resolver.
+                    return Ok(None);
+                }
             }
         }
     }
diff --git a/crates/knot/Cargo.toml b/crates/knot/Cargo.toml
index f20d407..13b6a08 100644
--- a/crates/knot/Cargo.toml
+++ b/crates/knot/Cargo.toml
@@ -7,6 +7,7 @@ repository.workspace = true
 license.workspace = true
 edition.workspace = true
 publish.workspace = true
+rust-version.workspace = true
 
 [dependencies]
 anyhow = "1.0.99"
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..e7f22fb
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,2 @@
+[toolchain]
+channel = "1.86"