diff --git a/.github/workflows/container_dev.yml b/.github/workflows/container_dev.yml
index 19ddf9c51..993d9e356 100644
--- a/.github/workflows/container_dev.yml
+++ b/.github/workflows/container_dev.yml
@@ -61,6 +61,18 @@ jobs:
           restore-keys: |
             rust-docker-dev-${{ matrix.target }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          protoc=$(find ~/.cargo/registry/src -path '*protoc-bin-vendored-linux-x86_64*/bin/protoc' | head -1)
+          test -x "$protoc" || { echo "no vendored protoc in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       - name: Build normal variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
diff --git a/.github/workflows/container_latest.yml b/.github/workflows/container_latest.yml
index 55f2bd7f0..655b15edc 100644
--- a/.github/workflows/container_latest.yml
+++ b/.github/workflows/container_latest.yml
@@ -105,6 +105,18 @@ jobs:
           restore-keys: |
             rust-docker-${{ matrix.target }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          protoc=$(find ~/.cargo/registry/src -path '*protoc-bin-vendored-linux-x86_64*/bin/protoc' | head -1)
+          test -x "$protoc" || { echo "no vendored protoc in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       - name: Build large-disk variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
diff --git a/.github/workflows/container_release_unified.yml b/.github/workflows/container_release_unified.yml
index f8177061b..00835a8f3 100644
--- a/.github/workflows/container_release_unified.yml
+++ b/.github/workflows/container_release_unified.yml
@@ -89,6 +89,18 @@ jobs:
           restore-keys: |
             rust-docker-${{ matrix.target }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          protoc=$(find ~/.cargo/registry/src -path '*protoc-bin-vendored-linux-x86_64*/bin/protoc' | head -1)
+          test -x "$protoc" || { echo "no vendored protoc in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       - name: Build large-disk variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
diff --git a/.github/workflows/rust-worker-tests.yml b/.github/workflows/rust-worker-tests.yml
index c86a3a347..3df9b2a9f 100644
--- a/.github/workflows/rust-worker-tests.yml
+++ b/.github/workflows/rust-worker-tests.yml
@@ -53,6 +53,18 @@ jobs:
           restore-keys: |
             rust-worker-${{ steps.toolchain.outputs.fingerprint }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          protoc=$(find ~/.cargo/registry/src -path '*protoc-bin-vendored-linux-x86_64*/bin/protoc' | head -1)
+          test -x "$protoc" || { echo "no vendored protoc in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       # The release profile is what ships, and it is where the release and the
       # container builds would otherwise discover a break for the first time.
       - name: Build the plugin workers
diff --git a/.github/workflows/rust_binaries_release.yml b/.github/workflows/rust_binaries_release.yml
index bccc1b1e8..6f1bbcf23 100644
--- a/.github/workflows/rust_binaries_release.yml
+++ b/.github/workflows/rust_binaries_release.yml
@@ -159,6 +159,18 @@ jobs:
           restore-keys: |
             rust-worker-release-${{ matrix.target }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          protoc=$(find ~/.cargo/registry/src -path '*protoc-bin-vendored-linux-x86_64*/bin/protoc' | head -1)
+          test -x "$protoc" || { echo "no vendored protoc in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       - name: Build the Rust maintenance worker
         run: |
           cd seaweed-worker