diff --git a/crates/vestige-core/src/codebase/patterns.rs b/crates/vestige-core/src/codebase/patterns.rs
index e6835b0..38d2f70 100644
--- a/crates/vestige-core/src/codebase/patterns.rs
+++ b/crates/vestige-core/src/codebase/patterns.rs
@@ -449,7 +449,7 @@ impl PatternDetector {
     pub fn delete_pattern(&mut self, pattern_id: &str) -> Result<()> {
         if self.patterns.remove(pattern_id).is_some() {
             // Clean up indexes
-            for (_, ids) in self.patterns_by_language.iter_mut() {
+            for ids in self.patterns_by_language.values_mut() {
                 ids.retain(|id| id != pattern_id);
             }
             self.pattern_keywords.remove(pattern_id);
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..54aad2b
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,11 @@
+# Pin the toolchain so CI, release builds, and contributors all compile and lint
+# against the same Rust. Without this, CI floats to whatever stable is newest and
+# a Rust release can turn main red with no code change: 1.97.0 landed on 2026-07-09
+# with a stricter `clippy::for_kv_map` and broke CI on a line that had been in the
+# tree since v1.0.0.
+#
+# Bump this deliberately, and run `cargo clippy --workspace --all-targets -- -D warnings`
+# when you do.
+[toolchain]
+channel = "1.97.1"
+components = ["rustfmt", "clippy"]