diff --git a/update_and_deploy_fips.sh b/update_and_deploy_fips.sh
index 01b4249..3867d71 100755
--- a/update_and_deploy_fips.sh
+++ b/update_and_deploy_fips.sh
@@ -95,11 +95,19 @@ ensure_base_build_deps() {
 }
 
 ensure_rust_toolchain() {
+  # rustup installs into ~/.cargo/bin, which may not be present in non-login shells.
+  # Load rustup environment first, then decide if install is actually needed.
+  if [[ -f "${HOME}/.cargo/env" ]]; then
+    # shellcheck disable=SC1090
+    source "${HOME}/.cargo/env"
+  fi
+  export PATH="${HOME}/.cargo/bin:${PATH}"
+
   if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
     return
   fi
 
-  echo "==> Rust toolchain not found; installing rustup + cargo"
+  echo "==> Rust toolchain not found in current PATH; installing rustup + cargo"
 
   if ! command -v curl >/dev/null 2>&1; then
     ensure_base_build_deps
@@ -107,11 +115,11 @@ ensure_rust_toolchain() {
 
   curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
 
-  export PATH="${HOME}/.cargo/bin:${PATH}"
   if [[ -f "${HOME}/.cargo/env" ]]; then
     # shellcheck disable=SC1090
     source "${HOME}/.cargo/env"
   fi
+  export PATH="${HOME}/.cargo/bin:${PATH}"
 
   if ! command -v cargo >/dev/null 2>&1; then
     echo "Error: cargo still not available after rustup install." >&2