fuzz: move rustflag handing into fuzz.sh

diff --git a/.github/workflows/cron-daily-fuzz.yml b/.github/workflows/cron-daily-fuzz.yml
index 9e2f2f1a..4c5c69b6 100644
--- a/.github/workflows/cron-daily-fuzz.yml
+++ b/.github/workflows/cron-daily-fuzz.yml
@@ -36,17 +36,10 @@ jobs:
       - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
         with:
           toolchain: '1.74.0'
-      - run: cargo install --locked --version 0.12.0 cargo-fuzz
       - name: Fuzz shard ${{ matrix.shard_id }}
+        working-directory: fuzz
         run: |
           shard_targets=($(cargo fuzz list | sort | awk -v shard=${{ matrix.shard_id }} 'BEGIN{i=0} {if (i++ % 16 == shard) print}'))
           for target in "${shard_targets[@]}"; do
-            if [[ "$target" =~ ^bitcoin ]]; then
-              export RUSTFLAGS='--cfg=hashes_fuzz --cfg=secp256k1_fuzz'
-            else
-              unset RUSTFLAGS
-            fi
-            echo "Using RUSTFLAGS: ${RUSTFLAGS:-<empty>}"
-            cd fuzz && ./fuzz.sh "$target"
-            cd ..
+            ./fuzz.sh "$target"
           done
diff --git a/fuzz/fuzz.sh b/fuzz/fuzz.sh
index 3a4aa602..e4052637 100755
--- a/fuzz/fuzz.sh
+++ b/fuzz/fuzz.sh
@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
-# This script is used to briefly fuzz every target when no target is provided. Otherwise, it will briefly fuzz the
-# provided target
+
+# Briefly fuzz the provided target, or all targets if none provided.
+#
+# Usage: fuzz.sh [TARGET] [-max_total_time=SECONDS]
 
 set -euox pipefail
 
@@ -55,8 +57,15 @@ rustc --version
 cargo install --force --locked --version 0.12.0 cargo-fuzz
 for targetFile in $targetFiles; do
   targetName=$(targetFileToName "$targetFile")
+
   echo "Fuzzing target $targetName ($targetFile) for $max_total_time seconds"
+  # Enable fuzz stubs in the hashes and cryptography libraries by default,
+  # unless we are fuzzing the hashes targets themselves.
+  fuzz_rustflags=''
+  if [[ ! "$targetName" =~ ^hashes_ ]]; then
+    fuzz_rustflags='--cfg=hashes_fuzz --cfg=secp256k1_fuzz'
+  fi
   # cargo-fuzz will check for the corpus at fuzz/corpus/<target>
-  cargo +nightly fuzz run "$targetName" -- -max_total_time="$max_total_time"
+  RUSTFLAGS="$RUSTFLAGS $fuzz_rustflags" cargo +nightly fuzz run "$targetName" -- -max_total_time="$max_total_time"
   checkReport "$targetName"
 done