diff --git a/Dockerfile b/Dockerfile
index 8318a10..60eabbd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -88,8 +88,15 @@ ENV CARGO_INSTALL_ROOT=/rust-tools
 # cargo-install fallback) aborts the entire batch and silently installs nothing,
 # even for tools that resolved fine. Isolating each tool's `|| true` is required
 # for "skip what's missing, keep what's available" to actually work.
+# GITHUB_TOKEN is passed as a BuildKit secret, not ARG/ENV, so its value never
+# persists in image layers or is visible via `docker history` — pass with
+# `docker buildx build --secret id=github_token,env=GITHUB_TOKEN` (optional,
+# only raises the GitHub API rate limit from 60 to 5000 req/hr). Without it,
+# `cargo binstall` resolving 50+ tools across two concurrent platform builds
+# exhausts the unauthenticated limit and silently skips most remaining tools.
 RUN --mount=type=cache,id=cargo-registry-native,sharing=shared,target=/usr/local/cargo/registry \
     --mount=type=cache,id=cargo-git-native,sharing=locked,target=/usr/local/cargo/git \
+    --mount=type=secret,id=github_token,env=GITHUB_TOKEN,required=false \
     set -o pipefail; \
     RUST_TARGET="$(cat /tmp/rust-target)"; \
     # Disable telemetry prompt — required for non-interactive builds
diff --git a/TODO.AI.md b/TODO.AI.md
new file mode 100644
index 0000000..703dbb4
--- /dev/null
+++ b/TODO.AI.md
@@ -0,0 +1,51 @@
+# TODO.AI.md
+
+## GitHub API rate-limiting drops most cross tools on arm64
+
+Verified 2026-08-21: a pushed multi-platform build (`docker.io/casjaysdev/rust:latest`,
+`linux/amd64,linux/arm64`) hit unauthenticated GitHub API rate-limiting (60 req/hr) during
+the `rust-tools` stage's `cargo binstall` tool loop, because both platforms build
+concurrently against the same shared, unauthenticated budget.
+
+Verified tool inventory in the pushed image:
+
+- `linux/amd64`: 14 of 60 tools missing (`cargo-edit`, `cargo-update`, `typos-cli`,
+  `taplo-cli`, `wasm-bindgen-cli`, `cargo-binutils`, `cargo-public-api`,
+  `cargo-spellcheck`, `cargo-dist`, `cargo-fuzz`, `flamegraph`, `probe-rs`, `sqlx-cli`,
+  `sea-orm-cli`)
+- `linux/arm64`: 40 of 60 tools missing (nearly the whole list, cascading from
+  `cargo-binstall` itself onward once the rate limit was exhausted)
+
+Fix applied in this session: `Dockerfile`'s `rust-tools` stage `cargo binstall` `RUN` now
+accepts an optional BuildKit secret (`--mount=type=secret,id=github_token,env=GITHUB_TOKEN,
+required=false`), matching the existing pattern already present in the sibling `go` image's
+Dockerfile. This raises the GitHub API rate limit from 60 to 5000 req/hr when a token is
+supplied.
+
+**Still open — outside this repo's scope:** the local build wrapper
+(`/usr/local/bin/buildx` → `/usr/local/share/CasjaysDev/scripts/bin/buildx`, a shared
+CasjaysDev script, not owned by this repo) does not pass `--secret id=github_token,
+env=GITHUB_TOKEN` on any `docker buildx build` invocation it generates — confirmed by
+grepping the saved build command in `/root/.config/myscripts/buildx/scripts/casjaysdev/
+rust-latest.sh`. Until that wrapper is updated (or the build is invoked manually with the
+secret flag), this Dockerfile fix has no effect and future pushed builds will keep hitting
+the same rate limit. This also affects the `go` image, which has carried the same
+secret-mount plumbing without the wrapper ever supplying it.
+
+Needs a decision from the user: fix the shared wrapper script (affects all dockersrc/
+casjaysdevdocker image builds, not just this repo), or accept manual
+`--secret id=github_token,env=GITHUB_TOKEN` invocation for now.
+
+## mingw-w64-gcc has no arm64 Alpine package
+
+Verified 2026-08-21 in the same build: `apk add --no-cache mingw-w64-gcc` succeeded on
+`linux/amd64` (installed `mingw-w64-gcc-15.2.0-r0`) but failed with `ERROR: unable to
+select packages: mingw-w64-gcc (no such package)` on `linux/arm64`. The install is wrapped
+in `|| true` in `rootfs/root/docker/setup/05-custom.sh`, so the build doesn't fail, but the
+`linux/arm64` variant of this image has the `x86_64-pc-windows-gnu` / `i686-pc-windows-gnu`
+rustup targets registered with no working `x86_64-w64-mingw32-gcc` / `i686-w64-mingw32-gcc`
+linker — `cargo build --target x86_64-pc-windows-gnu` will fail to link on that platform.
+This is an Alpine package-availability limitation (mingw-w64-gcc is not published for
+aarch64 in the Alpine repos as of this check), not a bug in this repo's scripts. No
+in-repo fix available; document as a known limitation if not already covered by README's
+existing Windows-MSVC/macOS-SDK caveats section.