diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 88e9bb2..c6375aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,6 +105,16 @@ jobs:
   build-arm-nucleo:
     name: Build ST Nucleo-F401RE (ARM Cortex-M4)
     runs-on: ubuntu-24.04
+
+    env:
+      # Pinned deliberately, as the runner image is: a toolchain upgrade should
+      # be a reviewable commit rather than something that changes underneath the
+      # targets. Kept in step with eclipse-threadx/threadx ci_cortex_m.yml, which
+      # pins the same release for the Cortex-M ports.
+      # Releases: https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads
+      GCC_VERSION: 14.3.rel1
+      GCC_TARGET: arm-none-eabi
+
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
@@ -116,13 +126,33 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y cmake ninja-build
 
-      - name: Install Pinned Arm GNU Toolchain 14.2.Rel1
+      - name: Cache the Arm GNU toolchain
+        id: cache-arm-gcc
+        uses: actions/cache@v4
+        with:
+          path: toolchain
+          key: arm-gnu-toolchain-${{ env.GCC_VERSION }}-x86_64-${{ env.GCC_TARGET }}
+
+      - name: Install the Arm GNU toolchain
+        if: steps.cache-arm-gcc.outputs.cache-hit != 'true'
+        run: |
+          set -eu
+          base="https://developer.arm.com/-/media/Files/downloads/gnu/${GCC_VERSION}/binrel"
+          archive="arm-gnu-toolchain-${GCC_VERSION}-x86_64-${GCC_TARGET}.tar.xz"
+          mkdir -p toolchain && cd toolchain
+          curl -fsSLO "$base/$archive"
+          curl -fsSLO "$base/$archive.sha256asc"
+          sha256sum -c "$archive.sha256asc"
+          tar xf "$archive"
+          rm -f "$archive"
+
+      - name: Put the toolchain on PATH
         run: |
-          wget -q https://developer.arm.com/-/media/Files/downloads/gnu/14.2.rel1/binrel/arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi.tar.xz
-          mkdir -p $HOME/arm-gcc
-          tar -xJf arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi.tar.xz -C $HOME/arm-gcc --strip-components=1
-          rm arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi.tar.xz
-          echo "$HOME/arm-gcc/bin" >> $GITHUB_PATH
+          set -eu
+          echo "$GITHUB_WORKSPACE/toolchain/arm-gnu-toolchain-${GCC_VERSION}-x86_64-${GCC_TARGET}/bin" >> "$GITHUB_PATH"
+
+      - name: Report the toolchain version
+        run: ${{ env.GCC_TARGET }}-gcc --version
 
       - name: Build NUCLEO-F401RE Demo
         run: |
diff --git a/targets/STMicroelectronics/NUCLEO_F401RE/README.md b/targets/STMicroelectronics/NUCLEO_F401RE/README.md
index 0c932dc..e1d3025 100644
--- a/targets/STMicroelectronics/NUCLEO_F401RE/README.md
+++ b/targets/STMicroelectronics/NUCLEO_F401RE/README.md
@@ -196,8 +196,8 @@ The BSP overrides `HAL_InitTick()` to configure TIM2 as the HAL timebase and pro
 ## Validation Record
 
 ### Verification Environment
-- **Toolchain**: Arm GNU Toolchain 14.2.Rel1 (GCC 14.2.1), the version pinned by CI
-- **Static ROM usage**: 22068 Bytes (4.21% of 512 KB Flash), including the startup self-tests
+- **Toolchain**: Arm GNU Toolchain 14.3.Rel1 (GCC 14.3.1), the version pinned by CI and by the ThreadX Cortex-M ports
+- **Static ROM usage**: 22064 Bytes (4.21% of 512 KB Flash), including the startup self-tests
 - **Static RAM usage**: 6000 Bytes (6.10% of 96 KB RAM)
 - **Dynamic Stack & Buffer allocation**: Stacks (8 x 1024 bytes) and Queue buffer (40 bytes) are dynamically allocated from the `TX_BYTE_POOL` (consuming 8312 bytes total, including pool headers).
 - **Board Hardware**: NUCLEO-F401RE