diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4069b1e53..7d2d79392 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -14,7 +14,7 @@ jobs:
     # This action builds the container and executes the test suite inside it.
     - uses: ./.github/actions/test
       with:
-        target: test
+        target: test-full
 
     - name: Ensure testing did not change sources
       run: git diff --exit-code
diff --git a/Makefile b/Makefile
index 922d99840..dead1ebe1 100644
--- a/Makefile
+++ b/Makefile
@@ -21,11 +21,10 @@ install-dev: build-dev
 	@helpers/install.sh --unoptimized
 
 .PHONY: test
-test: indent-check test-except-fuzz test-fuzz
+test: indent-check test-packages
 
-.PHONY: test-except-fuzz
-test-except-fuzz:
-	cargo build -p lucet-spectest # build but *not* run spectests to mitigate bitrot while spectests don't pass
+.PHONY: test-packages
+test-packages:
 	cargo test --no-fail-fast \
             -p lucet-runtime-internals \
             -p lucet-runtime \
@@ -35,6 +34,13 @@ test-except-fuzz:
             -p lucet-wasi \
             -p lucet-wasi-fuzz \
             -p lucet-validate
+
+.PHONY: test-full
+test-full: indent-check test-except-fuzz test-fuzz
+
+.PHONY: test-except-fuzz
+test-except-fuzz: test-packages
+	cargo build -p lucet-spectest # build but *not* run spectests to mitigate bitrot while spectests don't pass
 	cargo test --benches -p lucet-benchmarks -- --test # run the benchmarks in debug mode
 	helpers/lucet-toolchain-tests/signature.sh
 
diff --git a/helpers/indent.sh b/helpers/indent.sh
index 2c0d8dc80..be4faea7d 100755
--- a/helpers/indent.sh
+++ b/helpers/indent.sh
@@ -10,7 +10,7 @@ cleanup() {
 }
 trap cleanup 1 2 3 6 15
 
-RUSTFMT_VERSION=1.4.8-nightly
+RUSTFMT_VERSION=1.4.9-stable
 
 if ! rustfmt --version | grep -q "rustfmt $RUSTFMT_VERSION"; then
 	echo "indent requires rustfmt $RUSTFMT_VERSION"
diff --git a/lucet-runtime/lucet-runtime-internals/src/vmctx.rs b/lucet-runtime/lucet-runtime-internals/src/vmctx.rs
index a7ccdb6c8..b666f3574 100644
--- a/lucet-runtime/lucet-runtime-internals/src/vmctx.rs
+++ b/lucet-runtime/lucet-runtime-internals/src/vmctx.rs
@@ -272,11 +272,19 @@ impl Vmctx {
     /// This is useful when a hostcall takes a function pointer as its argument, as WebAssembly uses
     /// table indices as its runtime representation of function pointers.
     ///
+    /// # Safety
+    ///
     /// We do not currently reflect function type information into the Rust type system, so callers
     /// of the returned function must take care to cast it to the correct type before calling. The
     /// correct type will include the `vmctx` argument, which the caller is responsible for passing
     /// from its own context.
     ///
+    /// There is currently no guarantee that guest functions will return before faulting, or
+    /// terminating the instance in a subsequent hostcall. This means that any Rust resources that
+    /// are held open when the guest function is called might be leaked if the guest function, for
+    /// example, divides by zero. Work to make this safer is
+    /// [ongoing](https://github.com/bytecodealliance/lucet/pull/254).
+    ///
     /// ```no_run
     /// use lucet_runtime_macros::lucet_hostcall;
     /// use lucet_runtime_internals::lucet_hostcall_terminate;
diff --git a/rust-toolchain b/rust-toolchain
index 9e495a9f7..32b7211cb 100644
--- a/rust-toolchain
+++ b/rust-toolchain
@@ -1 +1 @@
-nightly-2019-09-25
+1.40.0