diff --git a/oracledesk-stellar/scripts/gen-bindings.sh b/oracledesk-stellar/scripts/gen-bindings.sh
index eeb476f..de6bddc 100755
--- a/oracledesk-stellar/scripts/gen-bindings.sh
+++ b/oracledesk-stellar/scripts/gen-bindings.sh
@@ -10,6 +10,28 @@
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
 
+# Source toolchain versions for deterministic builds
+source scripts/toolchain.env
+
+# Verify stellar CLI version for deterministic bindings generation
+INSTALLED_VERSION=$(stellar --version 2>/dev/null | awk '{print $2}' || echo "not found")
+if [ "$INSTALLED_VERSION" != "$STELLAR_CLI_VERSION" ]; then
+  if [ "${ALLOW_CLI_MISMATCH:-}" = "1" ]; then
+    echo "WARNING: stellar CLI version mismatch (expected $STELLAR_CLI_VERSION, got $INSTALLED_VERSION)" >&2
+    echo "         Bindings may differ from CI. Set ALLOW_CLI_MISMATCH=1 to suppress this warning." >&2
+  else
+    echo "ERROR: stellar CLI version mismatch" >&2
+    echo "  Expected: $STELLAR_CLI_VERSION" >&2
+    echo "  Installed: $INSTALLED_VERSION" >&2
+    echo "" >&2
+    echo "Install the correct version with:" >&2
+    echo "  cargo install --locked stellar-cli --version $STELLAR_CLI_VERSION" >&2
+    echo "" >&2
+    echo "Or set ALLOW_CLI_MISMATCH=1 to proceed anyway (not recommended)." >&2
+    exit 1
+  fi
+fi
+
 WASM_DIR=target/wasm32v1-none/release
 OUT_DIR=packages/bindings
 
@@ -21,18 +43,21 @@ for f in market_core resolver reasoning_registry treasury timelock router; do
   fi
 done
 
-declare -A NAMES=(
-  [market_core]="market-core"
-  [resolver]="resolver"
-  [reasoning_registry]="reasoning-registry"
-  [treasury]="treasury"
-  [timelock]="timelock"
-  [router]="router"
+# Fixed iteration order for deterministic bindings generation
+# Format: wasm_name:pkg_name
+CONTRACTS=(
+  "market_core:market-core"
+  "resolver:resolver"
+  "reasoning_registry:reasoning-registry"
+  "treasury:treasury"
+  "timelock:timelock"
+  "router:router"
 )
 
 mkdir -p "$OUT_DIR"
-for wasm_name in "${!NAMES[@]}"; do
-  pkg_name=${NAMES[$wasm_name]}
+for entry in "${CONTRACTS[@]}"; do
+  wasm_name="${entry%%:*}"
+  pkg_name="${entry##*:}"
   echo "==> generating bindings for $pkg_name" >&2
   # `--overwrite` deletes files it does not generate, including the committed
   # package-lock.json — which would make CI's "bindings are stale" diff fail on
diff --git a/oracledesk-stellar/scripts/toolchain.env b/oracledesk-stellar/scripts/toolchain.env
new file mode 100644
index 0000000..6277b9c
--- /dev/null
+++ b/oracledesk-stellar/scripts/toolchain.env
@@ -0,0 +1,7 @@
+# Pinned versions for deterministic builds and bindings generation
+# Source this file from scripts to ensure consistent tooling across local
+# and CI environments.
+
+# Stellar CLI version for contract bindings generation
+# Must match the version used in .github/workflows/ci.yml
+STELLAR_CLI_VERSION=27.1.0