diff --git a/.github/workflows/build-native.yml b/.github/workflows/build-native.yml
index c0239de8..4645c2b1 100644
--- a/.github/workflows/build-native.yml
+++ b/.github/workflows/build-native.yml
@@ -67,6 +67,20 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
+      - name: Verify cargo resolves to rustup proxy (macOS shim workaround)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          # macOS runners (most often `macos-14` ARM, but also observed on
+          # `macos-latest`/aarch64 builds — see #1136) intermittently expose
+          # a stale `cargo` on PATH that resolves to `rustup-init`, breaking
+          # `cargo metadata` invocations from napi-rs. Force the rustup
+          # proxy bin dir to the front of PATH and fail fast if cargo is
+          # unhealthy. Applied to all macOS matrix entries as a safety net.
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          "$HOME/.cargo/bin/cargo" --version
+          "$HOME/.cargo/bin/rustc" --version
+
       - name: Rust cache
         uses: Swatinem/rust-cache@v2
         with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index fa50ce50..7437c3b2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -176,6 +176,20 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
+      - name: Verify cargo resolves to rustup proxy (macOS shim workaround)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          # macOS runners (most often `macos-14` ARM, but also observed on
+          # `macos-latest`/aarch64 builds — see #1136) intermittently expose
+          # a stale `cargo` on PATH that resolves to `rustup-init`, breaking
+          # `cargo metadata` invocations from napi-rs. Force the rustup
+          # proxy bin dir to the front of PATH and fail fast if cargo is
+          # unhealthy. Applied to all macOS matrix entries as a safety net.
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          "$HOME/.cargo/bin/cargo" --version
+          "$HOME/.cargo/bin/rustc" --version
+
       - name: Rust cache
         uses: Swatinem/rust-cache@v2
         with: