diff --git a/mitamae/cookbooks/cargo-lambda/default.rb b/mitamae/cookbooks/cargo-lambda/default.rb
new file mode 100644
index 0000000..668c0b8
--- /dev/null
+++ b/mitamae/cookbooks/cargo-lambda/default.rb
@@ -0,0 +1,41 @@
+# cargo-lambda: build, test, and deploy AWS Lambda functions written in Rust.
+#
+# cargo-lambda is a Rust crate, but `cargo install cargo-lambda` compiles a huge
+# dependency tree (aws-sdk, gix, watchexec, ...) from source and runs the CI
+# containers out of disk ("No space left on device"). Install the prebuilt
+# release binary instead -- it is small and fast on every platform.
+#
+# It runs as a Cargo subcommand (`cargo lambda`), so it still needs cargo on
+# PATH: depend on the rust cookbook and drop the binary into ~/.cargo/bin, which
+# rust already creates, exports on PATH, and goss validation picks up.
+include_recipe File.expand_path('../rust', File.dirname(__FILE__))
+
+version = '1.9.1' # Latest release -- verify against github.com/cargo-lambda/cargo-lambda/releases
+home = ENV['HOME']
+arch = node[:os_arch] == 'arm64' ? 'aarch64' : 'x86_64'
+
+target =
+  if node[:platform] == 'darwin'
+    "#{arch}-apple-darwin"
+  elsif %w[ubuntu debian].include?(node[:platform])
+    # musl builds are statically linked, so they run on any glibc version.
+    "#{arch}-unknown-linux-musl"
+  else
+    unsupported_platform! node[:platform]
+  end
+
+archive = "cargo-lambda-v#{version}.#{target}.tar.gz"
+url = "https://github.com/cargo-lambda/cargo-lambda/releases/download/v#{version}/#{archive}"
+
+execute "install cargo-lambda #{version}" do
+  command <<~INSTALL
+    set -e
+    tmp="$(mktemp -d)"
+    curl -fsSL "#{url}" -o "$tmp/#{archive}"
+    tar xzf "$tmp/#{archive}" -C "$tmp"
+    bin="$(find "$tmp" -type f -name cargo-lambda | head -n 1)"
+    install -m 0755 "$bin" "#{home}/.cargo/bin/cargo-lambda"
+    rm -rf "$tmp"
+  INSTALL
+  not_if "cargo lambda --version 2>/dev/null | grep -q '#{version}'"
+end
diff --git a/mitamae/cookbooks/cargo-lambda/goss.yaml b/mitamae/cookbooks/cargo-lambda/goss.yaml
new file mode 100644
index 0000000..009a26b
--- /dev/null
+++ b/mitamae/cookbooks/cargo-lambda/goss.yaml
@@ -0,0 +1,4 @@
+command:
+  cargo lambda --version:
+    exit-status: 0
+    timeout: 10000
diff --git a/mitamae/roles/bamboo/default.rb b/mitamae/roles/bamboo/default.rb
index a24bef1..6e3ee3c 100644
--- a/mitamae/roles/bamboo/default.rb
+++ b/mitamae/roles/bamboo/default.rb
@@ -28,6 +28,7 @@
 
 # Cloud & DevOps
 include_recipe '../../cookbooks/awscli'
+include_recipe '../../cookbooks/cargo-lambda'
 include_recipe '../../cookbooks/gh'
 include_recipe '../../cookbooks/docker'
 include_recipe '../../cookbooks/devcontainer-cli'
diff --git a/mitamae/roles/bamboo/goss.yaml b/mitamae/roles/bamboo/goss.yaml
index aae35f1..1cdb43b 100644
--- a/mitamae/roles/bamboo/goss.yaml
+++ b/mitamae/roles/bamboo/goss.yaml
@@ -8,6 +8,7 @@ gossfile:
   ../../cookbooks/starship/goss.yaml: {}
   ../../cookbooks/lazygit/goss.yaml: {}
   ../../cookbooks/awscli/goss.yaml: {}
+  ../../cookbooks/cargo-lambda/goss.yaml: {}
   ../../cookbooks/gh/goss.yaml: {}
   ../../cookbooks/docker/goss.yaml: {}
   ../../cookbooks/devcontainer-cli/goss.yaml: {}
diff --git a/mitamae/roles/belle/default.rb b/mitamae/roles/belle/default.rb
index 70207f3..be97482 100644
--- a/mitamae/roles/belle/default.rb
+++ b/mitamae/roles/belle/default.rb
@@ -43,6 +43,7 @@
 
 # Cloud & DevOps
 include_recipe '../../cookbooks/awscli'
+include_recipe '../../cookbooks/cargo-lambda'
 include_recipe '../../cookbooks/cfn-lint'
 include_recipe '../../cookbooks/gh'
 include_recipe '../../cookbooks/docker'
diff --git a/mitamae/roles/belle/goss.yaml b/mitamae/roles/belle/goss.yaml
index 4bf5ba2..a5c970d 100644
--- a/mitamae/roles/belle/goss.yaml
+++ b/mitamae/roles/belle/goss.yaml
@@ -21,6 +21,7 @@ gossfile:
   ../../cookbooks/nmap/goss.yaml: {}
   ../../cookbooks/nikto/goss.yaml: {}
   ../../cookbooks/awscli/goss.yaml: {}
+  ../../cookbooks/cargo-lambda/goss.yaml: {}
   ../../cookbooks/cfn-lint/goss.yaml: {}
   ../../cookbooks/gh/goss.yaml: {}
   ../../cookbooks/docker/goss.yaml: {}
diff --git a/mitamae/roles/hercules/default.rb b/mitamae/roles/hercules/default.rb
index d9f750f..978c544 100644
--- a/mitamae/roles/hercules/default.rb
+++ b/mitamae/roles/hercules/default.rb
@@ -41,6 +41,7 @@
 
 # Cloud & DevOps
 include_recipe '../../cookbooks/awscli'
+include_recipe '../../cookbooks/cargo-lambda'
 include_recipe '../../cookbooks/cfn-lint'
 include_recipe '../../cookbooks/gh'
 include_recipe '../../cookbooks/docker'
diff --git a/mitamae/roles/hercules/goss.yaml b/mitamae/roles/hercules/goss.yaml
index 09980ba..96b8009 100644
--- a/mitamae/roles/hercules/goss.yaml
+++ b/mitamae/roles/hercules/goss.yaml
@@ -18,6 +18,7 @@ gossfile:
   ../../cookbooks/cloudflared/goss.yaml: {}
   ../../cookbooks/nmap/goss.yaml: {}
   ../../cookbooks/awscli/goss.yaml: {}
+  ../../cookbooks/cargo-lambda/goss.yaml: {}
   ../../cookbooks/cfn-lint/goss.yaml: {}
   ../../cookbooks/gh/goss.yaml: {}
   ../../cookbooks/docker/goss.yaml: {}
diff --git a/mitamae/roles/palm/default.rb b/mitamae/roles/palm/default.rb
index 548c2ef..1d8060e 100644
--- a/mitamae/roles/palm/default.rb
+++ b/mitamae/roles/palm/default.rb
@@ -53,6 +53,7 @@
 # Cloud & DevOps
 include_recipe '../../cookbooks/docker'
 include_recipe '../../cookbooks/awscli'
+include_recipe '../../cookbooks/cargo-lambda'
 include_recipe '../../cookbooks/gh'
 include_recipe '../../cookbooks/google-cloud-sdk'
 include_recipe '../../cookbooks/cfn-lint'
diff --git a/mitamae/roles/palm/goss.yaml b/mitamae/roles/palm/goss.yaml
index 2297c21..bc3000a 100644
--- a/mitamae/roles/palm/goss.yaml
+++ b/mitamae/roles/palm/goss.yaml
@@ -27,6 +27,7 @@ gossfile:
   ../../cookbooks/kotlin-lsp/goss.yaml: {}
   ../../cookbooks/docker/goss.yaml: {}
   ../../cookbooks/awscli/goss.yaml: {}
+  ../../cookbooks/cargo-lambda/goss.yaml: {}
   ../../cookbooks/gh/goss.yaml: {}
   ../../cookbooks/google-cloud-sdk/goss.yaml: {}
   ../../cookbooks/cfn-lint/goss.yaml: {}
diff --git a/mitamae/roles/pc137/default.rb b/mitamae/roles/pc137/default.rb
index 28f2825..118052c 100644
--- a/mitamae/roles/pc137/default.rb
+++ b/mitamae/roles/pc137/default.rb
@@ -40,6 +40,7 @@
 
 # Cloud & DevOps
 include_recipe '../../cookbooks/awscli'
+include_recipe '../../cookbooks/cargo-lambda'
 include_recipe '../../cookbooks/google-cloud-sdk'
 include_recipe '../../cookbooks/cfn-lint'
 include_recipe '../../cookbooks/gh'
diff --git a/mitamae/roles/pc137/goss.yaml b/mitamae/roles/pc137/goss.yaml
index aa17769..13a8e31 100644
--- a/mitamae/roles/pc137/goss.yaml
+++ b/mitamae/roles/pc137/goss.yaml
@@ -17,6 +17,7 @@ gossfile:
   ../../cookbooks/fastfetch/goss.yaml: {}
   ../../cookbooks/cloudflared/goss.yaml: {}
   ../../cookbooks/awscli/goss.yaml: {}
+  ../../cookbooks/cargo-lambda/goss.yaml: {}
   ../../cookbooks/google-cloud-sdk/goss.yaml: {}
   ../../cookbooks/cfn-lint/goss.yaml: {}
   ../../cookbooks/gh/goss.yaml: {}