diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e74248f..694f0f9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,26 +12,64 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  checks: write
-  pull-requests: write
+  contents: read
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            targets: wasm32-unknown-unknown
+          - os: macos-latest
+            targets: aarch64-apple-darwin,wasm32-unknown-unknown
+          - os: windows-latest
+            targets: wasm32-unknown-unknown
 
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
 
-    - name: Prework
+    - uses: ./setup
+      with:
+        targets: ${{ matrix.targets }}
+
+    - name: Verify toolchain
       run: |
-        printf '[package]\nname = "rust"\nversion = "0.1.0"\nedition = "2021"\n[dependencies]\n' > Cargo.toml
-        mkdir -p src
-        printf 'fn main() {\n    println!("Hello, world!");\n}\n' > src/main.rs
+        rustup component list --installed | grep '^clippy-'
+        rustup component list --installed | grep '^rustfmt-'
+        rustup target list --installed | grep '^wasm32-unknown-unknown$'
+        cargo build --manifest-path tests/Cargo.toml
+        cargo build --manifest-path tests/Cargo.toml --target wasm32-unknown-unknown
+      shell: bash
+
+    - name: Verify macOS target
+      run: rustup target list --installed | grep '^aarch64-apple-darwin$'
+      shell: bash
+      if: runner.os == 'macOS'
+
+  tools:
+    runs-on: ubuntu-latest
 
-    - name: Setup Rust
-      uses: ./setup
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
-    - name: Install
-      run: cargo build
+    - uses: ./setup
+      with:
+        tools: |
+          cargo-nextest@0.9.140
+          cargo-llvm-cov@0.8.7
+          wasm-bindgen-cli@0.2.126
+
+    - name: Verify Cargo tools
+      run: |
+        cargo nextest --version
+        cargo llvm-cov --version
+        wasm-bindgen --version
+      shell: bash
diff --git a/.gitignore b/.gitignore
index 365dfea..f3a662b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 AGENTS.md
 ROADMAP.md
+/tests/target/
diff --git a/README.md b/README.md
index a26a7d9..8fcd7e0 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
-# node
+# rust
 
-Helper actions for Node projects
+Helper actions for Rust projects
 
-| Name             | Action Reference         | Description                                            |
-| :--------------- | :----------------------- | :----------------------------------------------------- |
-| [setup](./setup) | `actions-ext/rust/setup` | An action to setup a rust compiler and enable caching. |
+| Name             | Action Reference         | Description                                             |
+| :--------------- | :----------------------- | :------------------------------------------------------ |
+| [setup](./setup) | `actions-ext/rust/setup` | Configure a Rust toolchain, targets, tools, and caching |
diff --git a/setup/README.md b/setup/README.md
index 9f5d7a6..a9cab61 100644
--- a/setup/README.md
+++ b/setup/README.md
@@ -1,10 +1,27 @@
-# setup-rust
-An action to setup a rust compiler and enable caching.
+# setup
+
+Configure a Rust toolchain, optional targets and Cargo tools, and caching.
 
 ## Usage
 
 ```yaml
 - name: Setup Rust
-  uses: actions-ext/rust/setup-rust@c9cdbe5cc8a2485bf2eb22644302559c741ca763
+  uses: actions-ext/rust/setup@7d919b14e08dc1155a267dffbcc58260bdfdd63b
+  with:
+    targets: wasm32-unknown-unknown
+    tools: |
+      cargo-nextest@0.9.140
+      cargo-llvm-cov@0.8.7
 ```
 
+Cargo tools require `crate@version` entries and are installed with an exact version requirement.
+
+## Inputs
+
+| Name         | Default          | Description                                              |
+| :----------- | :--------------- | :------------------------------------------------------- |
+| `toolchain`  | `stable`         | Rust toolchain to install.                               |
+| `components` | `clippy,rustfmt` | Comma-separated rustup components.                       |
+| `targets`    | Empty            | Comma-separated Rust targets.                            |
+| `tools`      | Empty            | Newline-separated Cargo tools in `crate@version` format. |
+| `cache_key`  | `rust`           | Additional Rust cache key.                               |
diff --git a/setup/action.yml b/setup/action.yml
index 5f86ad9..ab12d53 100644
--- a/setup/action.yml
+++ b/setup/action.yml
@@ -1,14 +1,22 @@
 name: Setup Rust
-description: 'Ensure Rust compiler and utilities are available, and setup caching'
+description: 'Configure a Rust toolchain, targets, Cargo tools, and caching'
 
 inputs:
-  kind:
-    type: choice
-    description: "Whether to install just a default target, or all targets (e.g. for during deployments / wheel building)"
-    default: "full"
-    options:
-        - full
-        - wasm
+  toolchain:
+    description: 'Rust toolchain to install'
+    default: 'stable'
+  components:
+    description: 'Comma-separated rustup components to install'
+    default: 'clippy,rustfmt'
+  targets:
+    description: 'Comma-separated Rust targets to install'
+    default: ''
+  tools:
+    description: 'Newline-separated Cargo tools in crate@version format'
+    default: ''
+  cache_key:
+    description: 'Additional Rust cache key'
+    default: 'rust'
 
 runs:
   using: 'composite'
@@ -16,8 +24,9 @@ runs:
     - name: Set up Rust
       uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # latest
       with:
-        toolchain: stable
-        components: clippy, rustfmt
+        toolchain: ${{ inputs.toolchain }}
+        components: ${{ inputs.components }}
+        targets: ${{ inputs.targets }}
 
     - name: Configure Cargo cache paths
       run: |
@@ -30,7 +39,7 @@ runs:
     - name: Setup Rust cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
-        key: ${{ runner.os }}-${{ inputs.kind }}
+        key: ${{ inputs.cache_key }}-${{ inputs.toolchain }}-${{ inputs.targets }}
         cache-targets: true
         cache-all-crates: true
         cache-bin: true
@@ -39,24 +48,28 @@ runs:
           .cargo
           .rustup
 
-    - run: |
-        rustup target add aarch64-unknown-linux-gnu
-        rustup target add x86_64-unknown-linux-gnu
+    - name: Install Cargo tools
+      env:
+        CARGO_TOOLS: ${{ inputs.tools }}
       shell: bash
-      if: ${{ inputs.kind == 'full' && runner.os == 'Linux' }}
-
-    - run: |
-        rustup target add aarch64-apple-darwin
-        rustup target add x86_64-apple-darwin
-      shell: bash
-      if: ${{ inputs.kind == 'full' && runner.os == 'macOS' }}
-
-    - run: |
-        rustup target add x86_64-pc-windows-msvc
-        rustup target add aarch64-pc-windows-msvc
-      shell: bash
-      if: ${{ inputs.kind == 'full' && runner.os == 'Windows' }}
-
-    - run: rustup target add wasm32-unknown-unknown
-      shell: bash
-      if: ${{ inputs.kind == 'wasm' }}
+      run: |
+        while IFS= read -r specification; do
+          specification="${specification%$'\r'}"
+          [ -z "$specification" ] && continue
+          case "$specification" in
+            *@*)
+              crate="${specification%@*}"
+              version="${specification##*@}"
+              ;;
+            *)
+              echo "Cargo tool must use crate@version format: $specification" >&2
+              exit 1
+              ;;
+          esac
+          if [ -z "$crate" ] || [ -z "$version" ]; then
+            echo "Cargo tool must use crate@version format: $specification" >&2
+            exit 1
+          fi
+          cargo install --locked "$crate" --version "=$version"
+        done <<< "$CARGO_TOOLS"
+      if: ${{ inputs.tools != '' }}
diff --git a/tests/Cargo.lock b/tests/Cargo.lock
new file mode 100644
index 0000000..cf12fe0
--- /dev/null
+++ b/tests/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "rust-action-test"
+version = "0.1.0"
diff --git a/tests/Cargo.toml b/tests/Cargo.toml
new file mode 100644
index 0000000..f8ef934
--- /dev/null
+++ b/tests/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "rust-action-test"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+path = "src/lib.rs"
diff --git a/tests/src/lib.rs b/tests/src/lib.rs
new file mode 100644
index 0000000..7953463
--- /dev/null
+++ b/tests/src/lib.rs
@@ -0,0 +1,13 @@
+pub fn add(left: usize, right: usize) -> usize {
+    left + right
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn adds_numbers() {
+        assert_eq!(add(2, 2), 4);
+    }
+}