diff --git a/driver/justfile b/driver/justfile
index ae3235a51..da5054f0d 100644
--- a/driver/justfile
+++ b/driver/justfile
@@ -6,7 +6,9 @@
 
 set shell := ["bash", "-euo", "pipefail", "-c"]
 
-export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
+# mbx's Cargo shim, which the dev shell exports, stays ahead of the nightly so cargo still builds through it.
+cargo_shim := if env("RUST2_CARGO_SHIM", "") == "" { "" } else { env("RUST2_CARGO_SHIM") + ":" }
+export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { cargo_shim + env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
 
 default:
     @just --list
diff --git a/ffi/justfile b/ffi/justfile
index 0c5711b03..aba3c16a4 100644
--- a/ffi/justfile
+++ b/ffi/justfile
@@ -6,7 +6,9 @@
 
 set shell := ["bash", "-euo", "pipefail", "-c"]
 
-export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
+# mbx's Cargo shim, which the dev shell exports, stays ahead of the nightly so cargo still builds through it.
+cargo_shim := if env("RUST2_CARGO_SHIM", "") == "" { "" } else { env("RUST2_CARGO_SHIM") + ":" }
+export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { cargo_shim + env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
 
 # The moq revision these recipes export by default: `just ts`'s, so both follow one moq.
 # just's own path is quoted wherever bash runs it: on Windows, its backslashes are escapes.
diff --git a/flake.nix b/flake.nix
index d45fdc5c7..57cea37a6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -246,6 +246,24 @@
             RUST2_TS_TOOLCHAIN = tsToolchain;
             RUST2_TS_SYSROOT = rust2-ts-std;
             KOTLINX_COROUTINES = "${kotlinx-coroutines}";
+            # The pinned toolchain goes on PATH ahead of everything the host had, which
+            # shadows the Cargo shim `mbx setup` installs. Put it back in front, as moq's dev
+            # shell does, so cargo builds through mbx's cache wherever the host set one up,
+            # the land gate included. The nightly projects' justfiles keep it ahead of their
+            # toolchain through RUST2_CARGO_SHIM. `setup --status` names the shim on its first
+            # line even when it is missing, and its exit code also fails over unrelated setup,
+            # so only the shim existing decides.
+            shellHook = ''
+              # An outer shell's shim must not outlive a host without one: the justfiles
+              # would still put its directory ahead of the toolchain.
+              unset RUST2_CARGO_SHIM
+              shim=$(mbx setup --status 2>/dev/null | sed -n '1s/.*: //p' || true)
+              if [ -x "$shim" ]; then
+                export RUST2_CARGO_SHIM=''${shim%/*}
+                export PATH="$RUST2_CARGO_SHIM:$PATH"
+              fi
+              unset shim
+            '';
           };
           # `just ts bench` adds Chrome and Firefox as engines. Apart for their size.
           devShells.bench = self.devShells.${system}.default.overrideAttrs (old: {
diff --git a/go/justfile b/go/justfile
index b78aab095..0273408ac 100644
--- a/go/justfile
+++ b/go/justfile
@@ -6,7 +6,9 @@
 
 set shell := ["bash", "-euo", "pipefail", "-c"]
 
-export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
+# mbx's Cargo shim, which the dev shell exports, stays ahead of the nightly so cargo still builds through it.
+cargo_shim := if env("RUST2_CARGO_SHIM", "") == "" { "" } else { env("RUST2_CARGO_SHIM") + ":" }
+export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { cargo_shim + env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
 
 default:
     @just --list
diff --git a/quest/m0/checks/cache.md b/quest/m0/checks/cache.md
index fccec89aa..d11234f96 100644
--- a/quest/m0/checks/cache.md
+++ b/quest/m0/checks/cache.md
@@ -3,8 +3,7 @@
 ## Goal
 
 The land gate's `just ci` builds through mbx, as moq's does, so a run rebuilds only what
-changed: measured on nixos2, root clippy falls from 399 to 83 CPU-seconds warm, and uniffi's
-test build from 291 to 20.
+changed.
 
 ## Plan
 
@@ -14,3 +13,9 @@ its compiler, target, and inputs. Local worktrees share it too, where the dev sh
 can.
 
 Public API: none.
+
+## Waiting
+
+- Maintainer: move the land host's mbx pin from 1.28.0 to 1.29.2 or later, then rerun `mbx setup` wherever a shim exists, since a shim runs the mbx its `mbx-target` file names. Check: `mbx --version` on the land host prints 1.29.2 or later, and the shim's `mbx-target` names that store path. 1.28.0 prints no real paths for files in a build script's `OUT_DIR` ([jdx/mr-boxington#896](https://github.com/jdx/mr-boxington/issues/896)).
+- Maintainer: give rust2's land instance moq's per-repository mbx profile, `id = 9`, `command = "just ci"`, `cpuQuota = 800`, `memoryHigh = "8G"`, `memorySwapMax = "1G"`, with `enable = lib.mkDefault false` until the next item. Check: the host config's `rust2` entry has these values.
+- Maintainer: enable that profile once [#426](https://github.com/moq-dev/rust2/pull/426) has merged. Check: a gate run's log shows `mbx[cache]: object cache: ...`.
diff --git a/ts/justfile b/ts/justfile
index 6dccaf776..0ba95cdf8 100644
--- a/ts/justfile
+++ b/ts/justfile
@@ -6,7 +6,9 @@
 
 set shell := ["bash", "-euo", "pipefail", "-c"]
 
-export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
+# mbx's Cargo shim, which the dev shell exports, stays ahead of the nightly so cargo still builds through it.
+cargo_shim := if env("RUST2_CARGO_SHIM", "") == "" { "" } else { env("RUST2_CARGO_SHIM") + ":" }
+export PATH := if env("RUST2_TS_TOOLCHAIN", "") == "" { env("PATH") } else { cargo_shim + env("RUST2_TS_TOOLCHAIN") / "bin:" + env("PATH") }
 
 # The model fixture, its own workspace, which builds moq-net at the moq pin.
 model := "fixtures/model/Cargo.toml"