From e3d2d8d5b9a7b4ee46c8d411311f4148909cef9a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 9 Jul 2026 17:45:31 +0000
Subject: [PATCH 1/9] Harden Docker mise tool installation against transient
 upstream failures

Two consecutive staging deploys failed because the tool-install layer hit
an HTTP 504 from an upstream tool source during `mise install`.

- Move the `mise install` layer above the turbo-pruned dependency-manifest
  COPYs in all five service Dockerfiles so the tool layer stays cached in
  the registry build cache across JS dependency churn and most builds
  never contact upstream tool sources at all
- Bump the pinned mise from 2026.4.22 to 2026.7.0: since v2026.4.24
  (jdx/mise#9414) mise retries transient download failures (5xx/408/429,
  network errors, mid-stream drops) with jittered backoff by default,
  whereas 2026.4.22 defaulted to zero retries so a single 504 was fatal
- Pin `biome` to 2.5.2 so builds no longer resolve "latest" on every run

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs
---
 .config/mise/config.toml                       |  3 ++-
 README.md                                      |  4 ++--
 apps/hash-ai-worker-ts/docker/Dockerfile       | 17 +++++++++++------
 apps/hash-api/docker/Dockerfile                | 17 +++++++++++------
 apps/hash-frontend/docker/Dockerfile           | 17 +++++++++++------
 apps/hash-graph/docker/Dockerfile              | 17 +++++++++++------
 apps/hash-integration-worker/docker/Dockerfile | 17 +++++++++++------
 7 files changed, 59 insertions(+), 33 deletions(-)

diff --git a/.config/mise/config.toml b/.config/mise/config.toml
index 1e62bc4097e..e6c59a2a715 100644
--- a/.config/mise/config.toml
+++ b/.config/mise/config.toml
@@ -1,4 +1,4 @@
-min_version = "2026.4.22"
+min_version = "2026.7.0"
 
 [env]
 TURBO_GLOBAL_WARNING_DISABLED = 1
@@ -24,6 +24,7 @@ java              = "25"
 protoc            = "32.1"
 
 # CLI tools
+biome                  = "2.5.2"
 "cargo:cargo-codspeed" = "4.1.0"
 "cargo:cargo-hack"     = "0.6.45"
 "cargo:cargo-insta"    = "1.47.2"
diff --git a/README.md b/README.md
index 8cd2238c2b5..4a162b4f070 100644
--- a/README.md
+++ b/README.md
@@ -69,7 +69,7 @@ Install these on the host first:
 - **[Docker](https://docs.docker.com/get-docker/)** (≥ 20.10), including:
   - **[Docker Compose](https://docs.docker.com/compose/)** (≥ 2.17) — orchestrates the stack
   - **[Docker Buildx](https://docs.docker.com/build/install-buildx/)** (≥ 0.10) — builds the images
-- **[mise](https://mise.jdx.dev/)** (≥ 2026.4.22) — installs and pins Node, Rust, protoc and the other required tool versions
+- **[mise](https://mise.jdx.dev/)** (≥ 2026.7.0) — installs and pins Node, Rust, protoc and the other required tool versions
 
 Give Docker at least **8 GB RAM** (Preferences → Resources) and keep ~15 GB of disk free for build artefacts, images and volumes.
 
@@ -80,7 +80,7 @@ git --version            # ≥ 2.17
 docker --version         # ≥ 20.10
 docker compose version   # ≥ 2.17
 docker buildx version    # ≥ 0.10
-mise --version           # ≥ 2026.4.22
+mise --version           # ≥ 2026.7.0
 ```
 
 #### Setup
diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile
index 14b33854740..7110d1ad3ac 100644
--- a/apps/hash-ai-worker-ts/docker/Dockerfile
+++ b/apps/hash-ai-worker-ts/docker/Dockerfile
@@ -14,7 +14,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -65,17 +65,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \
     yarn install --immutable && \
     yarn cache clean
 
diff --git a/apps/hash-api/docker/Dockerfile b/apps/hash-api/docker/Dockerfile
index 6b711f0cb0e..6492fdedf43 100644
--- a/apps/hash-api/docker/Dockerfile
+++ b/apps/hash-api/docker/Dockerfile
@@ -14,7 +14,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -65,17 +65,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \
     yarn install --immutable && \
     yarn cache clean
 
diff --git a/apps/hash-frontend/docker/Dockerfile b/apps/hash-frontend/docker/Dockerfile
index d1f469f9cd9..4a03b9f7958 100644
--- a/apps/hash-frontend/docker/Dockerfile
+++ b/apps/hash-frontend/docker/Dockerfile
@@ -12,7 +12,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -62,17 +62,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \
     yarn install --immutable && \
     yarn cache clean
 
diff --git a/apps/hash-graph/docker/Dockerfile b/apps/hash-graph/docker/Dockerfile
index b3a232f297a..0967c0da782 100644
--- a/apps/hash-graph/docker/Dockerfile
+++ b/apps/hash-graph/docker/Dockerfile
@@ -15,7 +15,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -66,17 +66,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential musl-tools && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential musl-tools && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo protoc && \
     yarn install --immutable && \
     yarn cache clean
 
diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile
index 52acc75b437..295cf90a893 100644
--- a/apps/hash-integration-worker/docker/Dockerfile
+++ b/apps/hash-integration-worker/docker/Dockerfile
@@ -14,7 +14,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -65,17 +65,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \
     yarn install --immutable && \
     yarn cache clean
 

From f168d0079f6dd70a004a003f2430bb460ae9b09c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 9 Jul 2026 17:59:31 +0000
Subject: [PATCH 2/9] Drop vestigial biome from integration-worker image,
 prepare mise lockfile, set evidence-based min_version

- Remove `biome` from the integration-worker `mise install` list: the repo
  migrated formatting to oxfmt, and nothing in the image's turbo build graph
  (build -> codegen tasks of the app and its workspace dependency closure)
  invokes biome or oxfmt, so no replacement is needed
- Enable `lockfile = true` so a committed `mise.lock` stays maintained by
  `mise install` once generated
- Set `min_version = "2026.6.13"` (instead of matching the Docker pin):
  the floor is driven by lockfile-content stability for this repo's tools
  (node source-lock outcomes in v2026.6.13, java lock identity in v2026.6.4,
  rust-toolchain.toml idiomatic locking in v2026.6.3) plus `mise lock`
  failing loudly on unresolvable tools (v2026.6.13); Docker images stay on
  MISE_VERSION=2026.7.0 which is above the floor

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs
---
 .config/mise/config.toml                       | 3 ++-
 README.md                                      | 4 ++--
 apps/hash-integration-worker/docker/Dockerfile | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.config/mise/config.toml b/.config/mise/config.toml
index e6c59a2a715..8325a9b022a 100644
--- a/.config/mise/config.toml
+++ b/.config/mise/config.toml
@@ -1,4 +1,4 @@
-min_version = "2026.7.0"
+min_version = "2026.6.13"
 
 [env]
 TURBO_GLOBAL_WARNING_DISABLED = 1
@@ -6,6 +6,7 @@ _.file                        = [".env", ".env.local"]
 
 [settings]
 idiomatic_version_file_enable_tools = ["rust"]
+lockfile                            = true
 minimum_release_age                 = "5d"
 
 [tools]
diff --git a/README.md b/README.md
index 4a162b4f070..19b4d076664 100644
--- a/README.md
+++ b/README.md
@@ -69,7 +69,7 @@ Install these on the host first:
 - **[Docker](https://docs.docker.com/get-docker/)** (≥ 20.10), including:
   - **[Docker Compose](https://docs.docker.com/compose/)** (≥ 2.17) — orchestrates the stack
   - **[Docker Buildx](https://docs.docker.com/build/install-buildx/)** (≥ 0.10) — builds the images
-- **[mise](https://mise.jdx.dev/)** (≥ 2026.7.0) — installs and pins Node, Rust, protoc and the other required tool versions
+- **[mise](https://mise.jdx.dev/)** (≥ 2026.6.13) — installs and pins Node, Rust, protoc and the other required tool versions
 
 Give Docker at least **8 GB RAM** (Preferences → Resources) and keep ~15 GB of disk free for build artefacts, images and volumes.
 
@@ -80,7 +80,7 @@ git --version            # ≥ 2.17
 docker --version         # ≥ 20.10
 docker compose version   # ≥ 2.17
 docker buildx version    # ≥ 0.10
-mise --version           # ≥ 2026.7.0
+mise --version           # ≥ 2026.6.13
 ```
 
 #### Setup
diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile
index 295cf90a893..fc970ad68ec 100644
--- a/apps/hash-integration-worker/docker/Dockerfile
+++ b/apps/hash-integration-worker/docker/Dockerfile
@@ -73,7 +73,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get install -y --no-install-recommends build-essential && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+    mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock

From e5a2a2c078aebfb877904765f44ff04c0ffc461c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 10 Jul 2026 07:20:22 +0000
Subject: [PATCH 3/9] Remove biome everywhere else: ai-worker-ts image, Vercel
 install scripts, mise pin

The repo's migration to oxfmt left biome installed but never invoked: no
script in any package.json runs biome, there is no biome.json, and the
only build-path formatter (hash-api's codegen afterOneFileWrite oxfmt
hook) is outside the ai-worker-ts / frontend / petrinaut-website
dependency closures. Drop biome from the ai-worker-ts Dockerfile tool
list, both vercel-install.sh scripts, and the [tools] pin added earlier
in this branch, so nothing resolves or downloads it at all.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs
---
 .config/mise/config.toml                 | 1 -
 apps/hash-ai-worker-ts/docker/Dockerfile | 2 +-
 apps/hash-frontend/vercel-install.sh     | 2 +-
 apps/petrinaut-website/vercel-install.sh | 2 +-
 4 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.config/mise/config.toml b/.config/mise/config.toml
index 8325a9b022a..5cde10f86d9 100644
--- a/.config/mise/config.toml
+++ b/.config/mise/config.toml
@@ -25,7 +25,6 @@ java              = "25"
 protoc            = "32.1"
 
 # CLI tools
-biome                  = "2.5.2"
 "cargo:cargo-codspeed" = "4.1.0"
 "cargo:cargo-hack"     = "0.6.45"
 "cargo:cargo-insta"    = "1.47.2"
diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile
index 7110d1ad3ac..b208dfd77be 100644
--- a/apps/hash-ai-worker-ts/docker/Dockerfile
+++ b/apps/hash-ai-worker-ts/docker/Dockerfile
@@ -73,7 +73,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get install -y --no-install-recommends build-essential && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+    mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
diff --git a/apps/hash-frontend/vercel-install.sh b/apps/hash-frontend/vercel-install.sh
index d194956fdb5..9b45597eee4 100755
--- a/apps/hash-frontend/vercel-install.sh
+++ b/apps/hash-frontend/vercel-install.sh
@@ -23,7 +23,7 @@ echo "Adding wasm32-unknown-unknown target"
 rustup target add wasm32-unknown-unknown
 
 echo "Installing prerequisites"
-mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 echo "Rust installation completed. Checking versions:"
 mise list rust
diff --git a/apps/petrinaut-website/vercel-install.sh b/apps/petrinaut-website/vercel-install.sh
index 90c53544c46..66d41db5b2d 100755
--- a/apps/petrinaut-website/vercel-install.sh
+++ b/apps/petrinaut-website/vercel-install.sh
@@ -20,7 +20,7 @@ export RUSTUP_AUTO_INSTALL=0
 mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml)
 
 echo "Installing prerequisites"
-mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 echo "Rust installation completed. Checking versions:"
 mise list rust

From cf3363cede85ce322d9b345758dd4a3954b74ae7 Mon Sep 17 00:00:00 2001
From: Tim Diekmann <post@timdiekmann.de>
Date: Mon, 13 Jul 2026 14:34:13 +0200
Subject: [PATCH 4/9] Generate mise.lock

---
 .config/mise/mise.lock | 242 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 242 insertions(+)
 create mode 100644 .config/mise/mise.lock

diff --git a/.config/mise/mise.lock b/.config/mise/mise.lock
new file mode 100644
index 00000000000..719a4117566
--- /dev/null
+++ b/.config/mise/mise.lock
@@ -0,0 +1,242 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
+
+[[tools.cargo-binstall]]
+version = "1.19.1"
+backend = "aqua:cargo-bins/cargo-binstall"
+
+[tools.cargo-binstall."platforms.linux-arm64"]
+checksum = "sha256:2001eee8da26705ad9627e57a25c23eb4639647521205f3e4a7b4e09d067d199"
+url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/cargo-binstall-aarch64-unknown-linux-musl.tgz"
+url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413600212"
+provenance = "github-attestations"
+
+[tools.cargo-binstall."platforms.linux-x64"]
+checksum = "sha256:4a50fcf01418862e2fa8e4076cb6cb80ff4061b0c0b1464e71a63ce01ee29bde"
+url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/cargo-binstall-x86_64-unknown-linux-musl.tgz"
+url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413599465"
+provenance = "github-attestations"
+
+[tools.cargo-binstall."platforms.macos-arm64"]
+checksum = "sha256:bf9da6a27e432784f361cfbc70a6d04e548abc548470ae9a7587c3cffb8fb0a7"
+url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/cargo-binstall-aarch64-apple-darwin.zip"
+url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413600458"
+provenance = "github-attestations"
+
+[[tools."cargo:cargo-codspeed"]]
+version = "4.1.0"
+backend = "cargo:cargo-codspeed"
+
+[[tools."cargo:cargo-hack"]]
+version = "0.6.45"
+backend = "cargo:cargo-hack"
+
+[[tools."cargo:cargo-insta"]]
+version = "1.47.2"
+backend = "cargo:cargo-insta"
+
+[[tools."cargo:cargo-llvm-cov"]]
+version = "0.8.7"
+backend = "cargo:cargo-llvm-cov"
+
+[[tools."cargo:cargo-nextest"]]
+version = "0.9.137"
+backend = "cargo:cargo-nextest"
+
+[[tools."cargo:wasm-opt"]]
+version = "0.116.1"
+backend = "cargo:wasm-opt"
+
+[[tools."cargo:wasm-pack"]]
+version = "0.15.0"
+backend = "cargo:wasm-pack"
+
+[[tools.java]]
+version = "25.0.2"
+backend = "core:java"
+
+[tools.java.options]
+shorthand_vendor = "openjdk"
+
+[tools.java."platforms.linux-arm64"]
+checksum = "sha256:671208d205e70c9805da45a483f670d49dd64654990a7b7223ccffb2abb070dd"
+url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_linux-aarch64_bin.tar.gz"
+
+[tools.java."platforms.linux-x64"]
+checksum = "sha256:555ce0821e4fe175ea50d54518cd6fbece9663c1998de529bc6ce429534457df"
+url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_linux-x64_bin.tar.gz"
+
+[tools.java."platforms.macos-arm64"]
+checksum = "sha256:7581b0d1752cd5acbf39e286c03f07b6cd6c205b562eb2fe753ff0253cf4c1bf"
+url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_macos-aarch64_bin.tar.gz"
+
+[[tools.just]]
+version = "1.51.0"
+backend = "aqua:casey/just"
+
+[tools.just."platforms.linux-arm64"]
+checksum = "sha256:ed7ec466b77709198fd4afed253dba0270203ba5eb1c006bee2b0139090284f5"
+url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/casey/just/releases/assets/416466462"
+
+[tools.just."platforms.linux-x64"]
+checksum = "sha256:c8f085ca3e885723c341d06243fc291b5abfdc8bbe3b2c076b117de490387b59"
+url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/casey/just/releases/assets/416466152"
+
+[tools.just."platforms.macos-arm64"]
+checksum = "sha256:61e3f1b8a545ff064b091eab4b6e14f8cc743ff15549be293b1e92f5b1467002"
+url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/casey/just/releases/assets/416466044"
+
+[[tools.markdownlint-cli2]]
+version = "0.22.1"
+backend = "npm:markdownlint-cli2"
+
+[[tools.node]]
+version = "22.21.1"
+backend = "core:node"
+
+[tools.node."platforms.linux-arm64"]
+checksum = "sha256:c86830dedf77f8941faa6c5a9c863bdfdd1927a336a46943decc06a38f80bfb2"
+url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-linux-arm64.tar.gz"
+
+[tools.node."platforms.linux-x64"]
+checksum = "sha256:219a152ea859861d75adea578bdec3dce8143853c13c5187f40c40e77b0143b2"
+url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-linux-x64.tar.gz"
+
+[tools.node."platforms.macos-arm64"]
+checksum = "sha256:c170d6554fba83d41d25a76cdbad85487c077e51fa73519e41ac885aa429d8af"
+url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-darwin-arm64.tar.gz"
+
+[[tools."npm:@napi-rs/cli"]]
+version = "3.7.0"
+backend = "npm:@napi-rs/cli"
+
+[[tools."npm:@redocly/cli"]]
+version = "2.31.5"
+backend = "npm:@redocly/cli"
+
+[[tools."npm:renovate"]]
+version = "43.212.4"
+backend = "npm:renovate"
+
+[[tools."npm:turbo"]]
+version = "2.6.3"
+backend = "npm:turbo"
+
+[[tools.oxfmt]]
+version = "0.50.0"
+backend = "npm:oxfmt"
+
+[[tools."pipx:sqlfluff"]]
+version = "3.4.2"
+backend = "pipx:sqlfluff"
+
+[[tools.protoc]]
+version = "35.1"
+backend = "aqua:protocolbuffers/protobuf/protoc"
+
+[tools.protoc."platforms.linux-arm64"]
+checksum = "sha256:01bf9d08808c7f96678b63f4bd8efa559bb4f83d5a7a270d5edaf507f9d5d9cf"
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-linux-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060236"
+
+[tools.protoc."platforms.linux-x64"]
+checksum = "sha256:6930ebf62bd4ea607b98fff052596c6ee564b9835b4ce172c75a3f53ae9d91b7"
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-linux-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060247"
+
+[tools.protoc."platforms.macos-arm64"]
+checksum = "sha256:193289af0470c6a1aada357d4fba0bbf8d78bfaac8b5e42ca30af2ef75583de2"
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-osx-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060249"
+
+[[tools.rust]]
+version = "nightly-2026-07-06"
+backend = "core:rust"
+
+[tools.rust.options]
+components = "clippy,llvm-tools-preview,miri,rust-analyzer,rust-src,rustc-codegen-cranelift-preview,rustfmt"
+
+[[tools.sentry-cli]]
+version = "2.52.0"
+backend = "aqua:getsentry/sentry-cli"
+
+[tools.sentry-cli."platforms.linux-arm64"]
+checksum = "sha256:1db6a70093828bd3a017f585a2717e83ffb01f2aee671900669ae49de5261c4f"
+url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Linux-aarch64"
+url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142098"
+
+[tools.sentry-cli."platforms.linux-x64"]
+checksum = "sha256:6149cf765590ef5adf2e8bc47ca236ba9100b38d600dd148b3bc435693c7e6a5"
+url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Linux-x86_64"
+url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142106"
+
+[tools.sentry-cli."platforms.macos-arm64"]
+checksum = "sha256:4d1781961252c670a89b765ed192dc06caebf2e3bff7cc99ce9f817c56a8ab55"
+url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Darwin-arm64"
+url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142093"
+
+[[tools.taplo]]
+version = "0.10.0"
+backend = "aqua:tamasfe/taplo"
+
+[tools.taplo."platforms.linux-arm64"]
+url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-aarch64.gz"
+url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322597"
+
+[tools.taplo."platforms.linux-x64"]
+url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz"
+url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600"
+
+[tools.taplo."platforms.macos-arm64"]
+url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-aarch64.gz"
+url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323110"
+
+[[tools."ubi:terrastruct/d2"]]
+version = "0.7.1"
+backend = "ubi:terrastruct/d2"
+
+[[tools.uv]]
+version = "0.11.18"
+backend = "aqua:astral-sh/uv"
+
+[tools.uv."platforms.linux-arm64"]
+checksum = "sha256:6d895725333680bf7633ad635baff8e49dc45d3b52e00b2b3adf6ced41f2ebe2"
+url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541698"
+provenance = "github-attestations"
+
+[tools.uv."platforms.linux-x64"]
+checksum = "sha256:a095a969fc8357f42e35652e0554525a47a29010ddb814bd82650c2ffa7d6d62"
+url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541798"
+provenance = "github-attestations"
+
+[tools.uv."platforms.macos-arm64"]
+checksum = "sha256:1a7adf8dadae3b55853115d13a8bf564d219597ad13824b93b213706933863e5"
+url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541676"
+provenance = "github-attestations"
+
+[[tools.yq]]
+version = "4.53.2"
+backend = "aqua:mikefarah/yq"
+
+[tools.yq."platforms.linux-arm64"]
+checksum = "sha256:03061b2a50c7a498de2bbb92d7cb078ce433011f085a4994117c2726be4106ea"
+url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_linux_arm64"
+url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368442"
+provenance = "cosign"
+
+[tools.yq."platforms.linux-x64"]
+checksum = "sha256:d56bf5c6819e8e696340c312bd70f849dc1678a7cda9c2ad63eebd906371d56b"
+url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_linux_amd64"
+url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368450"
+provenance = "cosign"
+
+[tools.yq."platforms.macos-arm64"]
+checksum = "sha256:616b0a0f6a5b79d746f05a169c2b9bb40dee00c605ef165b9a1c1681bba738ac"
+url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_amd64"
+url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368453"
+provenance = "cosign"

From db084e0720fd3f93b16ce69949683e7faab9056c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Jul 2026 12:43:26 +0000
Subject: [PATCH 5/9] Fix wrong-arch asset in mise.lock macos-arm64 yq entry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The macos-arm64 platform entry for yq pointed at the yq_darwin_amd64
asset (and carried its checksum), so Apple Silicon installs under
lockfile mode would fetch the x86_64 binary. Point it at
yq_darwin_arm64 with its sha256, verified two ways: computed locally
from the downloaded asset (a Mach-O arm64 executable) and matching the
SHA-256 column of the release's published `checksums` file (column
mapping cross-checked against the lockfile's known-good linux_amd64 and
darwin_amd64 values). url_api is omitted; it is optional in the schema
and mise drops it itself when an entry's artifact URL changes — the
next `mise lock` run will repopulate it.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs
---
 .config/mise/mise.lock | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.config/mise/mise.lock b/.config/mise/mise.lock
index 719a4117566..78ada15e7e6 100644
--- a/.config/mise/mise.lock
+++ b/.config/mise/mise.lock
@@ -236,7 +236,6 @@ url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368450"
 provenance = "cosign"
 
 [tools.yq."platforms.macos-arm64"]
-checksum = "sha256:616b0a0f6a5b79d746f05a169c2b9bb40dee00c605ef165b9a1c1681bba738ac"
-url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_amd64"
-url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368453"
+checksum = "sha256:541ba2287560df70f561955e2d7f7e1cd00cf2a15a884f6b5c87a4bfa887bc07"
+url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_arm64"
 provenance = "cosign"

From 965fa87c414c9d23f577b258c1f587a57bde86aa Mon Sep 17 00:00:00 2001
From: Tim Diekmann <post@timdiekmann.de>
Date: Mon, 13 Jul 2026 15:06:23 +0200
Subject: [PATCH 6/9] Generate mise.lock

---
 .config/mise/mise.lock | 50 ++++++++++++++++++++++++++++++++++++++++--
 Cargo.lock             |  1 +
 2 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/.config/mise/mise.lock b/.config/mise/mise.lock
index 78ada15e7e6..a0b941c3084 100644
--- a/.config/mise/mise.lock
+++ b/.config/mise/mise.lock
@@ -22,6 +22,12 @@ url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/ca
 url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413600458"
 provenance = "github-attestations"
 
+[tools.cargo-binstall."platforms.macos-x64"]
+checksum = "sha256:39257851fe4fd8cc9dd81fb318f15d589b7178b74165879eddeda8062bd9fcf2"
+url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/cargo-binstall-x86_64-apple-darwin.zip"
+url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413599769"
+provenance = "github-attestations"
+
 [[tools."cargo:cargo-codspeed"]]
 version = "4.1.0"
 backend = "cargo:cargo-codspeed"
@@ -69,6 +75,10 @@ url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162
 checksum = "sha256:7581b0d1752cd5acbf39e286c03f07b6cd6c205b562eb2fe753ff0253cf4c1bf"
 url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_macos-aarch64_bin.tar.gz"
 
+[tools.java."platforms.macos-x64"]
+checksum = "sha256:4ec2f4bc47b057fdf9cda07af27fae8f3605e90fa963d4240d63baeb46ede460"
+url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_macos-x64_bin.tar.gz"
+
 [[tools.just]]
 version = "1.51.0"
 backend = "aqua:casey/just"
@@ -88,6 +98,11 @@ checksum = "sha256:61e3f1b8a545ff064b091eab4b6e14f8cc743ff15549be293b1e92f5b1467
 url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-aarch64-apple-darwin.tar.gz"
 url_api = "https://api.github.com/repos/casey/just/releases/assets/416466044"
 
+[tools.just."platforms.macos-x64"]
+checksum = "sha256:d583e45f1f9fcdd26069ad2fe3bb9dea414756d8d0752eb9093974cb5c0246f0"
+url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/casey/just/releases/assets/416466221"
+
 [[tools.markdownlint-cli2]]
 version = "0.22.1"
 backend = "npm:markdownlint-cli2"
@@ -108,6 +123,10 @@ url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-linux-x64.tar.gz"
 checksum = "sha256:c170d6554fba83d41d25a76cdbad85487c077e51fa73519e41ac885aa429d8af"
 url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-darwin-arm64.tar.gz"
 
+[tools.node."platforms.macos-x64"]
+checksum = "sha256:8e3dc89614debe66c2a6ad2313a1adb06eb37db6cd6c40d7de6f7d987f7d1afd"
+url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-darwin-x64.tar.gz"
+
 [[tools."npm:@napi-rs/cli"]]
 version = "3.7.0"
 backend = "npm:@napi-rs/cli"
@@ -151,6 +170,11 @@ checksum = "sha256:193289af0470c6a1aada357d4fba0bbf8d78bfaac8b5e42ca30af2ef75583
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-osx-aarch_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060249"
 
+[tools.protoc."platforms.macos-x64"]
+checksum = "sha256:537d73604a344ded6fc94e98e07e529d4fe3e4a0b09e59905353950fafc2a1f7"
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-osx-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060254"
+
 [[tools.rust]]
 version = "nightly-2026-07-06"
 backend = "core:rust"
@@ -177,6 +201,11 @@ checksum = "sha256:4d1781961252c670a89b765ed192dc06caebf2e3bff7cc99ce9f817c56a8a
 url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Darwin-arm64"
 url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142093"
 
+[tools.sentry-cli."platforms.macos-x64"]
+checksum = "sha256:63c6a6a1cf6f1410299b1359bb68f08370e901456933d3d12f21c1ec31365f9c"
+url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Darwin-x86_64"
+url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142099"
+
 [[tools.taplo]]
 version = "0.10.0"
 backend = "aqua:tamasfe/taplo"
@@ -193,6 +222,10 @@ url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600"
 url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-aarch64.gz"
 url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323110"
 
+[tools.taplo."platforms.macos-x64"]
+url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-x86_64.gz"
+url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323116"
+
 [[tools."ubi:terrastruct/d2"]]
 version = "0.7.1"
 backend = "ubi:terrastruct/d2"
@@ -219,6 +252,12 @@ url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-aarch64-appl
 url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541676"
 provenance = "github-attestations"
 
+[tools.uv."platforms.macos-x64"]
+checksum = "sha256:00a61e3db99b53c927a7e6c4ccdccb898aa3253d07928822211e9dc570a25661"
+url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541772"
+provenance = "github-attestations"
+
 [[tools.yq]]
 version = "4.53.2"
 backend = "aqua:mikefarah/yq"
@@ -236,6 +275,13 @@ url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368450"
 provenance = "cosign"
 
 [tools.yq."platforms.macos-arm64"]
-checksum = "sha256:541ba2287560df70f561955e2d7f7e1cd00cf2a15a884f6b5c87a4bfa887bc07"
-url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_arm64"
+checksum = "sha256:616b0a0f6a5b79d746f05a169c2b9bb40dee00c605ef165b9a1c1681bba738ac"
+url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_amd64"
+url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368453"
+provenance = "cosign"
+
+[tools.yq."platforms.macos-x64"]
+checksum = "sha256:616b0a0f6a5b79d746f05a169c2b9bb40dee00c605ef165b9a1c1681bba738ac"
+url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_amd64"
+url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368453"
 provenance = "cosign"
diff --git a/Cargo.lock b/Cargo.lock
index 4d14da98724..c7b8ea1e630 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4047,6 +4047,7 @@ dependencies = [
  "temporalio-client",
  "temporalio-common",
  "thiserror 2.0.18",
+ "tokio",
  "tracing",
  "tracing-opentelemetry 0.33.0",
  "type-system",

From 373ac55c568561073d2f71be3614f7219a295b6a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Jul 2026 13:33:30 +0000
Subject: [PATCH 7/9] Validate mise lockfile in CI

Add a 'Mise lockfile' job to the Lint workflow (linux-x64 + linux-arm64)
that exercises mise's native locked mode:

- 'mise install --locked --dry-run' fails when a configured tool is
  missing from mise.lock or lacks a pre-resolved URL for the platform,
  catching stale or incomplete lockfiles without downloading.
- 'mise install --locked <url-locked tools>' downloads the locked URLs
  and verifies sha256 checksums and sizes natively, failing earlier and
  cheaper than the Docker builds.

The job skips gracefully on branches where mise.lock does not exist and
is wired into the 'passed' gate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs
---
 .github/workflows/lint.yml | 54 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 53 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c8b85c97272..fc226992c3e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -397,9 +397,58 @@ jobs:
           title: "SQLFluff Lint"
           input: "annotations.json"
 
+  mise-lock:
+    name: Mise lockfile (${{ matrix.runner }})
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # The lockfile does not exist on `main` yet (it lands with #9000), so
+      # skip gracefully when it is absent instead of failing.
+      - name: Check for lockfile
+        id: lockfile
+        run: echo "exists=$([[ -f .config/mise/mise.lock ]] && echo true || echo false)" | tee -a $GITHUB_OUTPUT
+
+      - name: Install mise
+        if: steps.lockfile.outputs.exists == 'true'
+        uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3.5.1
+        with:
+          install: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # `--locked` makes mise fail if any configured tool is missing from the
+      # lockfile or, for URL-locked backends, has no pre-resolved URL for
+      # this platform. `--dry-run` validates without downloading.
+      - name: Validate lockfile covers configured tools
+        if: steps.lockfile.outputs.exists == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: mise install --locked --dry-run
+
+      # Download the tools that have pre-resolved URLs in the lockfile so
+      # mise verifies their sha256 checksums and sizes. This catches a broken
+      # or tampered lockfile entry before the (slower) Docker builds do.
+      # Keep the list in sync with the tools carrying `platforms.*` entries
+      # in `mise.lock`; the dry-run step above already fails on tools missing
+      # from the lockfile. Cargo/npm/pipx tools are excluded, as they install
+      # through their own package managers and have no locked URLs to verify.
+      - name: Install URL-locked tools
+        if: steps.lockfile.outputs.exists == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: mise install --locked cargo-binstall java just node protoc sentry-cli taplo uv yq
+
   passed:
     name: Linting passed
-    needs: [setup, package, global]
+    needs: [setup, package, global, mise-lock]
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -412,6 +461,9 @@ jobs:
       - name: Check global results
         run: |
           [[ ${{ needs.global.result }} =~ success|skipped ]]
+      - name: Check mise lockfile results
+        run: |
+          [[ ${{ needs.mise-lock.result }} =~ success|skipped ]]
 
       - name: Notify Slack on failure
         uses: rtCamp/action-slack-notify@c58b60ee33df2229ed2d2eed86eeaf7e6c527c5a

From ac17eac2e6b93d53196f60ab89156b22045d7781 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Jul 2026 13:44:49 +0000
Subject: [PATCH 8/9] Derive URL-locked tool list from the lockfile instead of
 hardcoding

URL-locked tools are exactly those with 'platforms.*' sections in
mise.lock, so extract them at runtime rather than maintaining a
hardcoded list that would fall out of sync.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs
---
 .github/workflows/lint.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index fc226992c3e..8a79be09c92 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -436,15 +436,16 @@ jobs:
       # Download the tools that have pre-resolved URLs in the lockfile so
       # mise verifies their sha256 checksums and sizes. This catches a broken
       # or tampered lockfile entry before the (slower) Docker builds do.
-      # Keep the list in sync with the tools carrying `platforms.*` entries
-      # in `mise.lock`; the dry-run step above already fails on tools missing
-      # from the lockfile. Cargo/npm/pipx tools are excluded, as they install
-      # through their own package managers and have no locked URLs to verify.
+      # The list is derived from the lockfile itself: URL-locked tools are
+      # exactly those with `platforms.*` sections. Cargo/npm/pipx tools have
+      # none, as they install through their own package managers.
       - name: Install URL-locked tools
         if: steps.lockfile.outputs.exists == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise install --locked cargo-binstall java just node protoc sentry-cli taplo uv yq
+        run: |
+          TOOLS=$(sed -nE 's/^\[tools\."?([^]"]+)"?\."platforms\..*/\1/p' .config/mise/mise.lock | sort -u)
+          mise install --locked $TOOLS
 
   passed:
     name: Linting passed

From 9fcf84606dd87f83b298d7966fb4a2270dd3c2aa Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Jul 2026 14:50:51 +0000
Subject: [PATCH 9/9] Enforce locked mise installs across CI, Docker, and
 Vercel

Replace the dedicated lockfile-validation Lint job with '--locked' on
every mise install invocation, so each existing call validates the
lockfile where it runs:

- .github/actions/install-tools: add --locked to the mise-action
  install_args used by all workflow jobs.
- All five service Dockerfiles: add --locked to every mise install
  layer (the lockfile ships via the existing COPY of .config/mise).
- Both Vercel install scripts: add --locked to their mise install
  calls.
- Remove the now-redundant mise-lock job from the Lint workflow.

Commit .config/mise/mise.ci.lock (two version-only cargo entries) so
the CI environment's tools from config.ci.toml resolve under locked
mode, which hard-fails on any tool missing from its lockfile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs
---
 .config/mise/mise.ci.lock                     |  9 +++
 .github/actions/install-tools/action.yml      |  2 +-
 .github/workflows/lint.yml                    | 55 +------------------
 apps/hash-ai-worker-ts/docker/Dockerfile      | 10 ++--
 apps/hash-api/docker/Dockerfile               |  8 +--
 apps/hash-frontend/docker/Dockerfile          |  8 +--
 apps/hash-frontend/vercel-install.sh          |  4 +-
 apps/hash-graph/docker/Dockerfile             |  8 +--
 .../hash-integration-worker/docker/Dockerfile |  8 +--
 apps/petrinaut-website/vercel-install.sh      |  4 +-
 10 files changed, 36 insertions(+), 80 deletions(-)
 create mode 100644 .config/mise/mise.ci.lock

diff --git a/.config/mise/mise.ci.lock b/.config/mise/mise.ci.lock
new file mode 100644
index 00000000000..172b11c8f40
--- /dev/null
+++ b/.config/mise/mise.ci.lock
@@ -0,0 +1,9 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools."cargo:clippy-sarif"]]
+version = "0.8.0"
+backend = "cargo:clippy-sarif"
+
+[[tools."cargo:sarif-fmt"]]
+version = "0.8.0"
+backend = "cargo:sarif-fmt"
diff --git a/.github/actions/install-tools/action.yml b/.github/actions/install-tools/action.yml
index 0403843a713..65950513828 100644
--- a/.github/actions/install-tools/action.yml
+++ b/.github/actions/install-tools/action.yml
@@ -22,7 +22,7 @@ runs:
     - name: Run `mise install` with `ci` environment
       uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3.5.1
       with:
-        install_args: --env ci --jobs 1
+        install_args: --env ci --jobs 1 --locked
       env:
         MISE_VERBOSE: 1
         GITHUB_TOKEN: ${{ inputs.token }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8a79be09c92..c8b85c97272 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -397,59 +397,9 @@ jobs:
           title: "SQLFluff Lint"
           input: "annotations.json"
 
-  mise-lock:
-    name: Mise lockfile (${{ matrix.runner }})
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      # The lockfile does not exist on `main` yet (it lands with #9000), so
-      # skip gracefully when it is absent instead of failing.
-      - name: Check for lockfile
-        id: lockfile
-        run: echo "exists=$([[ -f .config/mise/mise.lock ]] && echo true || echo false)" | tee -a $GITHUB_OUTPUT
-
-      - name: Install mise
-        if: steps.lockfile.outputs.exists == 'true'
-        uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3.5.1
-        with:
-          install: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      # `--locked` makes mise fail if any configured tool is missing from the
-      # lockfile or, for URL-locked backends, has no pre-resolved URL for
-      # this platform. `--dry-run` validates without downloading.
-      - name: Validate lockfile covers configured tools
-        if: steps.lockfile.outputs.exists == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise install --locked --dry-run
-
-      # Download the tools that have pre-resolved URLs in the lockfile so
-      # mise verifies their sha256 checksums and sizes. This catches a broken
-      # or tampered lockfile entry before the (slower) Docker builds do.
-      # The list is derived from the lockfile itself: URL-locked tools are
-      # exactly those with `platforms.*` sections. Cargo/npm/pipx tools have
-      # none, as they install through their own package managers.
-      - name: Install URL-locked tools
-        if: steps.lockfile.outputs.exists == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          TOOLS=$(sed -nE 's/^\[tools\."?([^]"]+)"?\."platforms\..*/\1/p' .config/mise/mise.lock | sort -u)
-          mise install --locked $TOOLS
-
   passed:
     name: Linting passed
-    needs: [setup, package, global, mise-lock]
+    needs: [setup, package, global]
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -462,9 +412,6 @@ jobs:
       - name: Check global results
         run: |
           [[ ${{ needs.global.result }} =~ success|skipped ]]
-      - name: Check mise lockfile results
-        run: |
-          [[ ${{ needs.mise-lock.result }} =~ success|skipped ]]
 
       - name: Notify Slack on failure
         uses: rtCamp/action-slack-notify@c58b60ee33df2229ed2d2eed86eeaf7e6c527c5a
diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile
index b208dfd77be..035c8d6cde2 100644
--- a/apps/hash-ai-worker-ts/docker/Dockerfile
+++ b/apps/hash-ai-worker-ts/docker/Dockerfile
@@ -19,7 +19,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     eval "$(mise activate bash)" && \
-    mise install node
+    mise install --locked node
 
 
 FROM mise AS base
@@ -27,7 +27,7 @@ FROM mise AS base
 WORKDIR /app
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install npm:turbo yq
+    mise install --locked npm:turbo yq
 
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
@@ -51,7 +51,7 @@ ENV MISE_CARGO_HOME="/usr/local/cargo" \
 
 COPY rust-toolchain.toml .
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install yq && \
+    mise install --locked yq && \
     echo "Installing Rust toolchain: $(yq '.toolchain.channel' rust-toolchain.toml)" && \
     mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml) && \
     echo "Rust installation completed. Checking versions:" && \
@@ -73,7 +73,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get install -y --no-install-recommends build-essential && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+    mise install --locked node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
@@ -100,7 +100,7 @@ WORKDIR /usr/local/src/apps/hash-ai-worker-ts
 
 # Set a writable Corepack cache directory
 ENV COREPACK_HOME=/usr/local/src/var/corepack-cache
-RUN GITHUB_TOKEN="" mise install node && \
+RUN GITHUB_TOKEN="" mise install --locked node && \
     groupadd --system --gid 60000 hash && \
     useradd --system tsworker -G hash && \
     install -d -m 0775 -o tsworker -g hash /log /home/tsworker officeParserTemp/tempfiles $COREPACK_HOME && \
diff --git a/apps/hash-api/docker/Dockerfile b/apps/hash-api/docker/Dockerfile
index 6492fdedf43..1d12a45458b 100644
--- a/apps/hash-api/docker/Dockerfile
+++ b/apps/hash-api/docker/Dockerfile
@@ -19,7 +19,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     eval "$(mise activate bash)" && \
-    mise install node
+    mise install --locked node
 
 
 FROM mise AS base
@@ -27,7 +27,7 @@ FROM mise AS base
 WORKDIR /app
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install npm:turbo yq
+    mise install --locked npm:turbo yq
 
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
@@ -51,7 +51,7 @@ ENV MISE_CARGO_HOME="/usr/local/cargo" \
 
 COPY rust-toolchain.toml .
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install yq && \
+    mise install --locked yq && \
     echo "Installing Rust toolchain: $(yq '.toolchain.channel' rust-toolchain.toml)" && \
     mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml) && \
     echo "Rust installation completed. Checking versions:" && \
@@ -73,7 +73,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get install -y --no-install-recommends build-essential && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+    mise install --locked node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
diff --git a/apps/hash-frontend/docker/Dockerfile b/apps/hash-frontend/docker/Dockerfile
index 4a03b9f7958..7da8c959a6e 100644
--- a/apps/hash-frontend/docker/Dockerfile
+++ b/apps/hash-frontend/docker/Dockerfile
@@ -17,14 +17,14 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     eval "$(mise activate bash)" && \
-    mise install node
+    mise install --locked node
 
 FROM mise AS base
 
 WORKDIR /app
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install npm:turbo yq
+    mise install --locked npm:turbo yq
 
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
@@ -48,7 +48,7 @@ ENV MISE_CARGO_HOME="/usr/local/cargo" \
 
 COPY rust-toolchain.toml .
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install yq && \
+    mise install --locked yq && \
     echo "Installing Rust toolchain: $(yq '.toolchain.channel' rust-toolchain.toml)" && \
     mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml) && \
     echo "Rust installation completed. Checking versions:" && \
@@ -70,7 +70,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get install -y --no-install-recommends build-essential && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+    mise install --locked node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
diff --git a/apps/hash-frontend/vercel-install.sh b/apps/hash-frontend/vercel-install.sh
index 9b45597eee4..2bba896541a 100755
--- a/apps/hash-frontend/vercel-install.sh
+++ b/apps/hash-frontend/vercel-install.sh
@@ -14,7 +14,7 @@ yum-config-manager --add-repo https://mise.jdx.dev/rpm/mise.repo
 yum install -y mise
 eval "$(mise activate bash --shims)"
 
-mise install yq
+mise install --locked yq
 echo "Installing Rust toolchain: $(yq '.toolchain.channel' rust-toolchain.toml)"
 export RUSTUP_AUTO_INSTALL=0
 mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml)
@@ -23,7 +23,7 @@ echo "Adding wasm32-unknown-unknown target"
 rustup target add wasm32-unknown-unknown
 
 echo "Installing prerequisites"
-mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+mise install --locked node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 echo "Rust installation completed. Checking versions:"
 mise list rust
diff --git a/apps/hash-graph/docker/Dockerfile b/apps/hash-graph/docker/Dockerfile
index 0967c0da782..601cf91f43d 100644
--- a/apps/hash-graph/docker/Dockerfile
+++ b/apps/hash-graph/docker/Dockerfile
@@ -20,7 +20,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     eval "$(mise activate bash)" && \
-    mise install node
+    mise install --locked node
 
 
 FROM mise AS base
@@ -28,7 +28,7 @@ FROM mise AS base
 WORKDIR /app
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install npm:turbo yq
+    mise install --locked npm:turbo yq
 
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
@@ -52,7 +52,7 @@ ENV MISE_CARGO_HOME="/usr/local/cargo" \
 
 COPY rust-toolchain.toml .
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install yq && \
+    mise install --locked yq && \
     echo "Installing Rust toolchain: $(yq '.toolchain.channel' rust-toolchain.toml)" && \
     mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml) && \
     echo "Rust installation completed. Checking versions:" && \
@@ -74,7 +74,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get install -y --no-install-recommends build-essential musl-tools && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo protoc
+    mise install --locked node npm:turbo protoc
 
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile
index fc970ad68ec..b9fe2dcbc67 100644
--- a/apps/hash-integration-worker/docker/Dockerfile
+++ b/apps/hash-integration-worker/docker/Dockerfile
@@ -19,7 +19,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     eval "$(mise activate bash)" && \
-    mise install node
+    mise install --locked node
 
 
 FROM mise AS base
@@ -27,7 +27,7 @@ FROM mise AS base
 WORKDIR /app
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install npm:turbo yq
+    mise install --locked npm:turbo yq
 
 COPY . .
 
@@ -51,7 +51,7 @@ ENV MISE_CARGO_HOME="/usr/local/cargo" \
 
 COPY rust-toolchain.toml .
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    mise install yq && \
+    mise install --locked yq && \
     echo "Installing Rust toolchain: $(yq '.toolchain.channel' rust-toolchain.toml)" && \
     mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml) && \
     echo "Rust installation completed. Checking versions:" && \
@@ -73,7 +73,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get install -y --no-install-recommends build-essential && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+    mise install --locked node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
diff --git a/apps/petrinaut-website/vercel-install.sh b/apps/petrinaut-website/vercel-install.sh
index 66d41db5b2d..d3f53fe36f2 100755
--- a/apps/petrinaut-website/vercel-install.sh
+++ b/apps/petrinaut-website/vercel-install.sh
@@ -15,12 +15,12 @@ yum install -y mise
 eval "$(mise activate bash --shims)"
 
 echo "Installing Rust toolchain: $(yq '.toolchain.channel' rust-toolchain.toml)"
-mise install yq
+mise install --locked yq
 export RUSTUP_AUTO_INSTALL=0
 mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml)
 
 echo "Installing prerequisites"
-mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+mise install --locked node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 echo "Rust installation completed. Checking versions:"
 mise list rust