diff --git a/.github/workflows/dynamic-safety.yaml b/.github/workflows/dynamic-safety.yaml
index f10faa8fe..7ff4b1079 100644
--- a/.github/workflows/dynamic-safety.yaml
+++ b/.github/workflows/dynamic-safety.yaml
@@ -14,7 +14,7 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
   CARGO_BUILD_WARNINGS: deny
-  SAFETY_NIGHTLY: nightly-2026-02-21
+  SAFETY_NIGHTLY: nightly-2026-07-10
 
 jobs:
   dynamic-safety-changes:
diff --git a/Cargo.toml b/Cargo.toml
index b25fc324a..a36f36528 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,7 +9,7 @@ default-members = ["crates/graphcal-cli"]
 [workspace.package]
 version = "0.0.1-alpha.35"
 edition = "2024"
-rust-version = "1.95"
+rust-version = "1.99"
 description = "Type-safe, unit-aware, Git-friendly reactive programming language for engineering calculations"
 readme = "README.md"
 repository = "https://github.com/graphcal-lang/graphcal"
diff --git a/crates/graphcal-cli/build_support/engine.rs b/crates/graphcal-cli/build_support/engine.rs
index a0b7b5512..6a53a72ba 100644
--- a/crates/graphcal-cli/build_support/engine.rs
+++ b/crates/graphcal-cli/build_support/engine.rs
@@ -104,9 +104,10 @@ fn watch_tool(name: &str) -> Result<(), Error> {
 }
 
 /// Do not pass host coverage/sanitizer flags, wrappers, target directories, or
-/// jobserver tokens to a second target build. One worker uses the slot already
-/// owned by this build script. The engine always uses the repository toolchain,
-/// including when the native CLI is being checked with its older MSRV.
+/// jobserver tokens or dynamic-library search paths to a second target build.
+/// One worker uses the slot already owned by this build script. The engine always
+/// uses the repository toolchain, including when the native CLI is being checked
+/// with its older MSRV.
 fn rust_command(root: &Path, channel: &str, tool: &str) -> Command {
     let mut command = Command::new("rustup");
     env::vars_os()
@@ -162,6 +163,14 @@ pub fn isolated_variable(key: &str) -> bool {
                 | "MAKEFLAGS"
                 | "MFLAGS"
                 | "LLVM_PROFILE_FILE"
+                // Cargo includes the host compiler libraries here. Identical
+                // compilers installed under different rustup names can otherwise
+                // load the host rustc_driver and infer the wrong Wasm sysroot.
+                // Keep PATH: Windows needs it to locate rustup and other tools.
+                | "LD_LIBRARY_PATH"
+                | "DYLD_LIBRARY_PATH"
+                | "DYLD_FALLBACK_LIBRARY_PATH"
+                | "LIBPATH"
         )
 }
 
diff --git a/crates/graphcal-cli/tests/report_engine.rs b/crates/graphcal-cli/tests/report_engine.rs
index 592400a81..55217ea93 100644
--- a/crates/graphcal-cli/tests/report_engine.rs
+++ b/crates/graphcal-cli/tests/report_engine.rs
@@ -206,6 +206,19 @@ fn host_instrumentation_and_build_directories_are_isolated() {
     }
 }
 
+#[test]
+fn host_dynamic_library_paths_are_isolated_without_removing_tool_search_paths() {
+    for key in [
+        "LD_LIBRARY_PATH",
+        "DYLD_LIBRARY_PATH",
+        "DYLD_FALLBACK_LIBRARY_PATH",
+        "LIBPATH",
+    ] {
+        assert!(engine::isolated_variable(key), "{key}");
+    }
+    assert!(!engine::isolated_variable("PATH"));
+}
+
 #[test]
 fn source_fingerprint_tracks_dependency_assets_and_not_cli_only_edits() {
     let temp = tempfile::tempdir().unwrap();
diff --git a/docs/en/installation.md b/docs/en/installation.md
index d631bdf34..b49ffaf29 100644
--- a/docs/en/installation.md
+++ b/docs/en/installation.md
@@ -36,7 +36,7 @@ cargo binstall graphcal@<version>
 
 ### cargo install
 
-`cargo install` builds Graphcal from [crates.io](https://crates.io/crates/graphcal). It requires Rust 1.95 or later, which you can get from [rustup.rs](https://rustup.rs/):
+`cargo install` builds Graphcal from [crates.io](https://crates.io/crates/graphcal). It requires Rust 1.99 or later, which you can get from [rustup.rs](https://rustup.rs/):
 
 ```bash
 cargo install graphcal@<version> --locked
diff --git a/docs/ja/installation.md b/docs/ja/installation.md
index 5d838fa82..d9dac2364 100644
--- a/docs/ja/installation.md
+++ b/docs/ja/installation.md
@@ -36,7 +36,7 @@ cargo binstall graphcal@<version>
 
 ### cargo install { #cargo-install }
 
-`cargo install` は [crates.io](https://crates.io/crates/graphcal) のソースから Graphcal をビルドします。Rust 1.95 以降が必要です。Rust は [rustup.rs](https://rustup.rs/) から入手できます。
+`cargo install` は [crates.io](https://crates.io/crates/graphcal) のソースから Graphcal をビルドします。Rust 1.99 以降が必要です。Rust は [rustup.rs](https://rustup.rs/) から入手できます。
 
 ```bash
 cargo install graphcal@<version> --locked