fixed nightly selection

.clusterfuzzlite/Dockerfile

@@ -1,12 +1,18 @@
 # ClusterFuzzLite builder image (T4-3).
 #
-# Pinned to the Rust base builder; the nightly selection comes from
-# `fuzz/rust-toolchain.toml` (nearest toolchain file to the working
-# directory), so the root stable pin is never violated. `cargo-fuzz` is
-# installed here so `build.sh` stays a plain build script.
+# Pinned to the Rust base builder. The base image bakes `RUSTUP_TOOLCHAIN`
+# as an environment variable, which overrides any `rust-toolchain.toml`,
+# so the nightly is selected here explicitly (it must match
+# `fuzz/rust-toolchain.toml`, which governs the CI and local fuzz legs).
+# The root stable pin is never violated. `cargo-fuzz` is installed here so
+# `build.sh` stays a plain build script.
 FROM gcr.io/oss-fuzz-base/base-builder-rust:v1
 
-RUN cargo install cargo-fuzz --locked
+# Must match `fuzz/rust-toolchain.toml`: dated, not floating, so a
+# dependency can never again outgrow a stale preinstalled nightly
+# (`sqlx 0.9` needs rustc >= 1.94; the base image ships 1.91).
+ENV RUSTUP_TOOLCHAIN=nightly-2026-10-01
+RUN rustup toolchain install nightly-2026-10-01 && cargo install cargo-fuzz --locked
 
 COPY . "$SRC/d-oauth-server"
 WORKDIR "$SRC/d-oauth-server"