diff --git a/.github/actions/bootstrap/action.yml b/.github/actions/bootstrap/action.yml
new file mode 100644
index 0000000000..31e53acba8
--- /dev/null
+++ b/.github/actions/bootstrap/action.yml
@@ -0,0 +1,27 @@
+name: 'bootstrap'
+description: Bootstrap the Internet Identity build environment
+runs:
+  using: "composite"
+  steps:
+    - id: uname
+      shell: bash
+      run: |
+        # print include system info relevant for cache compatibility
+        uname="$(uname -mpsr)"
+        echo "uname value: $uname"
+        uname_hash="$(echo "$uname" | shasum -a 256 | head -c 10)"
+        echo "uname hash value: $uname_hash"
+        echo "::set-output name=uname-hash::$uname_hash"
+
+    # cache ic-cdk-optimizer
+    # NOTE: here we make sure to only cache ic-cdk-optimizer and _not_ e.g. the cargo target, since in some cases
+    # (clean builds) we build from scratch
+    # NOTE: we include the output of uname to ensure binary compatibility (e.g. same glibc)
+    - uses: actions/cache@v2
+      with:
+        path: ~/.cargo/bin
+        key: cargo-bin-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}-${{ steps.uname.outputs.uname-hash }}
+
+    - name: Bootstrap
+      shell: bash
+      run: ./scripts/bootstrap
diff --git a/.github/actions/check-build/action.yml b/.github/actions/check-build/action.yml
index a844017426..30e006b06d 100644
--- a/.github/actions/check-build/action.yml
+++ b/.github/actions/check-build/action.yml
@@ -1,34 +1,13 @@
 name: 'Check build'
-description: This action performs a clean, non-Docker build of II, and optionally checks the Wasm module sha256 against the 'sha256' argument. Nothing is cached except for ic-cdk-optimizer.
+description: This action performs a clean, non-Docker build of II, and optionally checks the Wasm module sha256 against the 'sha256' argument. Nothing is cached except for the bootstrap environment.
 inputs:
   sha256:
     description: The expected sha256 of the final Wasm module
     required: false
-  rust-version:
-    description: The rust version
-    required: true
-  ic-cdk-optimizer-version:
-    description: The ic-cdk-optimizer version
-    required: true
 runs:
   using: "composite"
   steps:
-    - name: Install Rust
-      shell: bash
-      run: |
-        rustup update "${{ inputs.rust-version }}" --no-self-update
-        rustup default "${{ inputs.rust-version }}"
-        rustup target add wasm32-unknown-unknown
-
-    - run: |
-        if [ ! -e "$HOME/.cargo/bin/ic-cdk-optimizer" ]
-        then
-          echo "installing cdk optimizer"
-          cargo install ic-cdk-optimizer --version "${{ inputs.ic-cdk-optimizer-version }}"
-        else
-          echo "NOT installing cdk optimizer"
-        fi
-      shell: bash
+    - uses: ./.github/actions/bootstrap
 
     # run the build
     - run: npm ci
diff --git a/.github/workflows/canister-tests.yml b/.github/workflows/canister-tests.yml
index 203e799ae0..88a30a4368 100644
--- a/.github/workflows/canister-tests.yml
+++ b/.github/workflows/canister-tests.yml
@@ -134,8 +134,6 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest, macos-latest ]
-    env:
-      RUSTC_VERSION: 1.58.1
     steps:
       - uses: actions/checkout@v2
 
@@ -149,13 +147,9 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-${{ env.RUSTC_VERSION }}-${{ hashFiles('**/Cargo.lock') }}-tests-1
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
 
-      - name: Install Rust
-        run: |
-          rustup update "$RUSTC_VERSION" --no-self-update
-          rustup default "$RUSTC_VERSION"
-          rustup target add wasm32-unknown-unknown
+      - uses: ./.github/actions/bootstrap
 
       - name: Create fake assets
         run : |
@@ -558,5 +552,3 @@ jobs:
         with:
           # we check that ubuntu builds match the docker build
           sha256: ${{ startsWith(matrix.os, 'ubuntu') && steps.sha256.outputs.sha256 || '' }}
-          rust-version: 1.58.1
-          ic-cdk-optimizer-version: 0.3.1
diff --git a/.github/workflows/cargo-tests.yml b/.github/workflows/cargo-tests.yml
index 4dabe951d5..118687153b 100644
--- a/.github/workflows/cargo-tests.yml
+++ b/.github/workflows/cargo-tests.yml
@@ -6,29 +6,13 @@ on:
 jobs:
   cargo-fmt:
     runs-on: ubuntu-latest
-    env:
-      RUSTC_VERSION: 1.58.1
-
     steps:
       - uses: actions/checkout@v2
-
-      - uses: actions/cache@v2
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}-1
-
-      - name: Install Rust
-        run: |
-          rustup update "$RUSTC_VERSION" --no-self-update
-          rustup default "$RUSTC_VERSION"
-          rustup target add wasm32-unknown-unknown
-          rustup component add rustfmt
+      - uses: ./.github/actions/bootstrap
 
       - name: Cargo fmt
         run: |
+          rustup component add rustfmt
           cargo fmt
       - name: Commit Formatting changes
         uses: EndBug/add-and-commit@v9
diff --git a/Dockerfile b/Dockerfile
index 4d80761de6..6b9c0574e8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,23 +29,13 @@ RUN npm --version
 
 # Install Rust and Cargo in /opt
 ENV RUSTUP_HOME=/opt/rustup \
-    CARGO_HOME=/opt/cargo \
-    PATH=/opt/cargo/bin:$PATH
-
-RUN curl --fail https://sh.rustup.rs -sSf \
-        | sh -s -- -y --default-toolchain ${rust_version}-x86_64-unknown-linux-gnu --no-modify-path && \
-    rustup default ${rust_version}-x86_64-unknown-linux-gnu && \
-    rustup target add wasm32-unknown-unknown
-
-ENV CARGO_HOME=/cargo \
-    CARGO_TARGET_DIR=/cargo_target \
+    CARGO_HOME=/cargo \
     PATH=/cargo/bin:$PATH
 
-# Install IC CDK optimizer
-# (keep version in sync with scripts/build)
-RUN cargo install ic-cdk-optimizer --version 0.3.1
-
 COPY ./scripts ./scripts
+COPY ./rust-toolchain.toml ./rust-toolchain.toml
+
+RUN ./scripts/bootstrap
 
 # Pre-build all cargo dependencies. Because cargo doesn't have a build option
 # to build only the dependecies, we pretend that our project is a simple, empty
@@ -56,6 +46,7 @@ COPY Cargo.toml .
 COPY src/internet_identity/Cargo.toml src/internet_identity/Cargo.toml
 COPY src/internet_identity_interface/Cargo.toml src/internet_identity_interface/Cargo.toml
 COPY src/canister_tests/Cargo.toml src/canister_tests/Cargo.toml
+ENV CARGO_TARGET_DIR=/cargo_target
 RUN mkdir -p src/internet_identity/src \
     && touch src/internet_identity/src/lib.rs \
     && mkdir -p src/internet_identity_interface/src \
diff --git a/scripts/bootstrap b/scripts/bootstrap
new file mode 100755
index 0000000000..68e89d327d
--- /dev/null
+++ b/scripts/bootstrap
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# install build dependencies (rustup + ic-cdk-optimizer)
+
+set -euo pipefail
+
+SCRIPTS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+cd "$SCRIPTS_DIR/.."
+
+function run() {
+    1>&2 echo "running $@"
+    rc=0 && "$@" || rc="$?"
+    if ! [ "$rc" -eq 0 ]
+    then
+        1>&2 echo "Bootstrap command failed: $@"
+        exit "$rc"
+    fi
+}
+
+rust_version=$(cat ./rust-toolchain.toml | sed -n 's/^channel[[:space:]]*=[[:space:]]"\(.*\)"/\1/p')
+echo "using rust version '$rust_version'"
+
+# here we set the toolchain to 'none' and rustup will pick up on ./rust-toolchain.toml
+run curl --fail https://sh.rustup.rs -sSf | run sh -s -- -y --default-toolchain "none" --no-modify-path
+
+echo "looking for ic-cdk-optimizer"
+if ! command -v ic-cdk-optimizer
+then
+    echo "installing ic-cdk-optimizer"
+    run cargo install ic-cdk-optimizer --version 0.3.1
+fi