I just realized that I never followed up on this question:
It turns out that the rattle was coming from the connectors holding down the large trim piece that lines the base of the windshield. It's a long piece of curved plastic with vents for the defroster and happens to have the VIN tag attached to it. If you pull this piece (using a wrapped screwdriver and some care), you'll see that it's held in place by some fiddly plastic fittings that insert into clips attached to the rest of the dash.
These little plastic bits are not held firmly in place and will rattle like a can of dried peas if you shake them. However, a dab of silicone on each one greatly reduces the rattle while not interfering with their ability to reconnect to the rest of the dash.