diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2cf7e2b7f..67e2d2aa60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,31 @@
 # Changelog
 
+## [2026.3.7](https://github.com/jdx/mise/compare/v2026.3.6..v2026.3.7) - 2026-03-10
+
+### 🐛 Bug Fixes
+
+- **(conda)** exclude transitive dependency binaries from PATH by @simonepri in [#8543](https://github.com/jdx/mise/pull/8543)
+
+### New Contributors
+
+- @simonepri made their first contribution in [#8543](https://github.com/jdx/mise/pull/8543)
+
+### 📦 Aqua Registry Updates
+
+#### New Packages (1)
+
+- [`stackrox/stackrox/roxctl`](https://github.com/stackrox/stackrox/roxctl)
+
+#### Updated Packages (7)
+
+- [`dprint/dprint`](https://github.com/dprint/dprint)
+- [`j178/prek`](https://github.com/j178/prek)
+- [`jdx/hk`](https://github.com/jdx/hk)
+- [`jdx/mise`](https://github.com/jdx/mise)
+- [`jdx/usage`](https://github.com/jdx/usage)
+- [`mvdan/sh`](https://github.com/mvdan/sh)
+- [`pnpm/pnpm`](https://github.com/pnpm/pnpm)
+
 ## [2026.3.6](https://github.com/jdx/mise/compare/v2026.3.5..v2026.3.6) - 2026-03-09
 
 ### 🐛 Bug Fixes
diff --git a/Cargo.lock b/Cargo.lock
index e96e048756..a017f8dfae 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -229,7 +229,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "aqua-registry"
-version = "2026.3.3"
+version = "2026.3.4"
 dependencies = [
  "expr-lang",
  "eyre",
@@ -5414,7 +5414,7 @@ dependencies = [
 
 [[package]]
 name = "mise"
-version = "2026.3.6"
+version = "2026.3.7"
 dependencies = [
  "age",
  "aho-corasick",
diff --git a/Cargo.toml b/Cargo.toml
index 199286fc59..12ebc8ad70 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,7 +8,7 @@ members = [
 
 [package]
 name = "mise"
-version = "2026.3.6"
+version = "2026.3.7"
 edition = "2024"
 description = "The front-end to your dev env"
 authors = ["Jeff Dickey (@jdx)"]
diff --git a/README.md b/README.md
index ae47b0bece..b87cf3f8cb 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ $ ~/.local/bin/mise --version
  / / / / / / (__  )  __/_____/  __/ / / /_____/ /_/ / / /_/ / /__/  __/
 /_/ /_/ /_/_/____/\___/      \___/_/ /_/     / .___/_/\__,_/\___/\___/
                                             /_/                 by @jdx
-2026.3.6 macos-arm64 (2026-03-09)
+2026.3.7 macos-arm64 (2026-03-10)
 ```
 
 Hook mise into your shell (pick the right one for your shell):
diff --git a/completions/_mise b/completions/_mise
index d5bb38d21f..70d65466a3 100644
--- a/completions/_mise
+++ b/completions/_mise
@@ -23,7 +23,7 @@ _mise() {
       return 1
   fi
 
-  local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_6.spec"
+  local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_7.spec"
   if [[ ! -f "$spec_file" ]]; then
     mise usage >| "$spec_file"
   fi
diff --git a/completions/mise.bash b/completions/mise.bash
index 5bf316d069..3925182207 100644
--- a/completions/mise.bash
+++ b/completions/mise.bash
@@ -9,7 +9,7 @@ _mise() {
 
 	local cur prev words cword was_split comp_args
     _comp_initialize -n : -- "$@" || return
-    local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_6.spec"
+    local spec_file="${TMPDIR:-/tmp}/usage__usage_spec_mise_2026_3_7.spec"
     if [[ ! -f "$spec_file" ]]; then
         mise usage >| "$spec_file"
     fi
diff --git a/completions/mise.fish b/completions/mise.fish
index e3e797f0fc..435e60ccc6 100644
--- a/completions/mise.fish
+++ b/completions/mise.fish
@@ -8,7 +8,7 @@ if ! type -p usage &> /dev/null
     return 1
 end
 set -l tmpdir (if set -q TMPDIR; echo $TMPDIR; else; echo /tmp; end)
-set -l spec_file "$tmpdir/usage__usage_spec_mise_2026_3_6.spec"
+set -l spec_file "$tmpdir/usage__usage_spec_mise_2026_3_7.spec"
 if not test -f "$spec_file"
     mise usage | string collect > "$spec_file"
 end
diff --git a/completions/mise.ps1 b/completions/mise.ps1
index 5b90cfa6f9..f7b06e34f7 100644
--- a/completions/mise.ps1
+++ b/completions/mise.ps1
@@ -10,7 +10,7 @@ Register-ArgumentCompleter -Native -CommandName 'mise' -ScriptBlock {
     param($wordToComplete, $commandAst, $cursorPosition)
 
     $tmpDir = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
-    $specFile = Join-Path $tmpDir "usage__usage_spec_mise_2026_3_6.kdl"
+    $specFile = Join-Path $tmpDir "usage__usage_spec_mise_2026_3_7.kdl"
 
     if (-not (Test-Path $specFile)) {
     mise usage | Out-File -FilePath $specFile -Encoding utf8
diff --git a/crates/aqua-registry/Cargo.toml b/crates/aqua-registry/Cargo.toml
index e744e322a1..dd40e380e2 100644
--- a/crates/aqua-registry/Cargo.toml
+++ b/crates/aqua-registry/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "aqua-registry"
-version = "2026.3.3"
+version = "2026.3.4"
 edition = "2024"
 description = "Aqua registry backend for mise"
 authors = ["Jeff Dickey (@jdx)"]
diff --git a/crates/aqua-registry/aqua-registry/pkgs/dprint/dprint/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/dprint/dprint/registry.yaml
index 107ac5c49a..bb02776af0 100644
--- a/crates/aqua-registry/aqua-registry/pkgs/dprint/dprint/registry.yaml
+++ b/crates/aqua-registry/aqua-registry/pkgs/dprint/dprint/registry.yaml
@@ -30,6 +30,19 @@ packages:
           type: github_release
           asset: SHASUMS256.txt
           algorithm: sha256
+      - version_constraint: semver("< 0.52.0")
+        asset: dprint-{{.Arch}}-{{.OS}}.zip
+        windows_arm_emulation: true
+        replacements:
+          amd64: x86_64
+          arm64: aarch64
+          darwin: apple-darwin
+          linux: unknown-linux-musl
+          windows: pc-windows-msvc
+        checksum:
+          type: github_release
+          asset: SHASUMS256.txt
+          algorithm: sha256
       - version_constraint: "true"
         asset: dprint-{{.Arch}}-{{.OS}}.zip
         windows_arm_emulation: true
@@ -43,3 +56,4 @@ packages:
           type: github_release
           asset: SHASUMS256.txt
           algorithm: sha256
+        github_immutable_release: true
diff --git a/crates/aqua-registry/aqua-registry/pkgs/j178/prek/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/j178/prek/registry.yaml
index b9c6e049a2..57afa54a37 100644
--- a/crates/aqua-registry/aqua-registry/pkgs/j178/prek/registry.yaml
+++ b/crates/aqua-registry/aqua-registry/pkgs/j178/prek/registry.yaml
@@ -92,6 +92,27 @@ packages:
           - darwin
           - windows
           - amd64
+      - version_constraint: semver("<= 0.1.6")
+        asset: prek-{{.Arch}}-{{.OS}}.{{.Format}}
+        format: tar.gz
+        files:
+          - name: prek
+            src: "{{.AssetWithoutExt}}/prek"
+        replacements:
+          amd64: x86_64
+          arm64: aarch64
+          darwin: apple-darwin
+          linux: unknown-linux-musl
+          windows: pc-windows-msvc
+        checksum:
+          type: github_release
+          asset: "{{.Asset}}.sha256"
+          algorithm: sha256
+        overrides:
+          - goos: windows
+            format: zip
+            files:
+              - name: prek
       - version_constraint: semver("<= 0.3.0")
         asset: prek-{{.Arch}}-{{.OS}}.{{.Format}}
         format: tar.gz
@@ -113,6 +134,7 @@ packages:
             format: zip
             files:
               - name: prek
+        github_immutable_release: true
       - version_constraint: "true"
         asset: prek-{{.Arch}}-{{.OS}}.{{.Format}}
         format: tar.gz
@@ -136,3 +158,4 @@ packages:
               - name: prek
         github_artifact_attestations:
           signer_workflow: j178/prek/.github/workflows/release.yml
+        github_immutable_release: true
diff --git a/crates/aqua-registry/aqua-registry/pkgs/jdx/hk/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/jdx/hk/registry.yaml
index 578d5b625b..46bc40a409 100644
--- a/crates/aqua-registry/aqua-registry/pkgs/jdx/hk/registry.yaml
+++ b/crates/aqua-registry/aqua-registry/pkgs/jdx/hk/registry.yaml
@@ -22,6 +22,25 @@ packages:
         supported_envs:
           - linux
           - darwin/arm64
+      - version_constraint: semver("< 1.11.0")
+        asset: hk-{{.Arch}}-{{.OS}}.{{.Format}}
+        format: tar.gz
+        replacements:
+          amd64: x86_64
+          arm64: aarch64
+          darwin: apple-darwin
+          linux: unknown-linux-gnu
+          windows: pc-windows-msvc
+        overrides:
+          - goos: darwin
+            replacements:
+              amd64: amd64
+          - goos: windows
+            format: zip
+        supported_envs:
+          - linux
+          - darwin/arm64
+          - windows
       - version_constraint: "true"
         asset: hk-{{.Arch}}-{{.OS}}.{{.Format}}
         format: tar.gz
@@ -41,3 +60,4 @@ packages:
           - linux
           - darwin/arm64
           - windows
+        github_immutable_release: true
diff --git a/crates/aqua-registry/aqua-registry/pkgs/jdx/mise/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/jdx/mise/registry.yaml
index a9538ff203..efe603c5de 100644
--- a/crates/aqua-registry/aqua-registry/pkgs/jdx/mise/registry.yaml
+++ b/crates/aqua-registry/aqua-registry/pkgs/jdx/mise/registry.yaml
@@ -38,6 +38,21 @@ packages:
           - darwin
       - version_constraint: semver(">= 2025.7.13, <= 2025.7.15")
         no_asset: true
+      - version_constraint: semver("<= 2025.8.21")
+        asset: mise-{{.Version}}-{{.OS}}-{{.Arch}}-musl.{{.Format}}
+        format: tar.gz
+        files:
+          - name: mise
+            src: mise/bin/mise
+        overrides:
+          - goos: darwin
+            asset: mise-{{.Version}}-{{.OS}}-{{.Arch}}.{{.Format}}
+        replacements:
+          amd64: x64
+          darwin: macos
+        supported_envs:
+          - linux
+          - darwin
       - version_constraint: "true"
         asset: mise-{{.Version}}-{{.OS}}-{{.Arch}}-musl.{{.Format}}
         format: tar.gz
@@ -53,3 +68,4 @@ packages:
         supported_envs:
           - linux
           - darwin
+        github_immutable_release: true
diff --git a/crates/aqua-registry/aqua-registry/pkgs/jdx/usage/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/jdx/usage/registry.yaml
index 0924989e0e..3646c4d5bb 100644
--- a/crates/aqua-registry/aqua-registry/pkgs/jdx/usage/registry.yaml
+++ b/crates/aqua-registry/aqua-registry/pkgs/jdx/usage/registry.yaml
@@ -25,6 +25,22 @@ packages:
           - darwin
       - version_constraint: semver("<= 0.7.2")
         no_asset: true
+      - version_constraint: semver("<= 2.2.0")
+        asset: usage-{{.Arch}}-{{.OS}}.{{.Format}}
+        format: tar.gz
+        replacements:
+          darwin: apple-darwin
+          linux: unknown-linux-musl
+        overrides:
+          - goos: linux
+            replacements:
+              amd64: x86_64
+              arm64: aarch64
+          - goos: darwin
+            asset: usage-universal-{{.OS}}.{{.Format}}
+        supported_envs:
+          - linux
+          - darwin
       - version_constraint: semver("<= 2.15.1")
         asset: usage-{{.Arch}}-{{.OS}}.{{.Format}}
         format: tar.gz
@@ -41,6 +57,7 @@ packages:
         supported_envs:
           - linux
           - darwin
+        github_immutable_release: true
       - version_constraint: "true"
         asset: usage-{{.Arch}}-{{.OS}}.{{.Format}}
         format: tar.gz
@@ -55,3 +72,4 @@ packages:
             asset: usage-universal-{{.OS}}.{{.Format}}
           - goos: windows
             format: zip
+        github_immutable_release: true
diff --git a/crates/aqua-registry/aqua-registry/pkgs/mvdan/sh/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/mvdan/sh/registry.yaml
index 9a15b5f71c..d36d97925d 100644
--- a/crates/aqua-registry/aqua-registry/pkgs/mvdan/sh/registry.yaml
+++ b/crates/aqua-registry/aqua-registry/pkgs/mvdan/sh/registry.yaml
@@ -17,7 +17,7 @@ packages:
           - amd64
         files:
           - name: shfmt
-      - version_constraint: "true"
+      - version_constraint: semver("<= 3.12.0")
         format: raw
         asset: shfmt_{{.Version}}_{{.OS}}_{{.Arch}}
         supported_envs:
@@ -30,3 +30,12 @@ packages:
           type: github_release
           asset: sha256sums.txt
           algorithm: sha256
+      - version_constraint: "true"
+        format: raw
+        asset: shfmt_{{.Version}}_{{.OS}}_{{.Arch}}
+        supported_envs:
+          - darwin
+          - linux
+          - amd64
+        files:
+          - name: shfmt
diff --git a/crates/aqua-registry/aqua-registry/pkgs/pnpm/pnpm/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/pnpm/pnpm/registry.yaml
index 8108440e60..501d87ff54 100644
--- a/crates/aqua-registry/aqua-registry/pkgs/pnpm/pnpm/registry.yaml
+++ b/crates/aqua-registry/aqua-registry/pkgs/pnpm/pnpm/registry.yaml
@@ -58,6 +58,18 @@ packages:
           windows: win
       - version_constraint: Version == "v7.0.0-alpha.1"
         no_asset: true
+      - version_constraint: semver("<= 10.26.1")
+        asset: pnpm-{{.OS}}-{{.Arch}}
+        format: raw
+        windows_arm_emulation: true
+        files:
+          - name: pnpm
+            link: pnpm
+            hard: true
+        replacements:
+          amd64: x64
+          darwin: macos
+          windows: win
       - version_constraint: "true"
         asset: pnpm-{{.OS}}-{{.Arch}}
         format: raw
@@ -70,3 +82,4 @@ packages:
           amd64: x64
           darwin: macos
           windows: win
+        github_immutable_release: true
diff --git a/crates/aqua-registry/aqua-registry/pkgs/stackrox/stackrox/roxctl/registry.yaml b/crates/aqua-registry/aqua-registry/pkgs/stackrox/stackrox/roxctl/registry.yaml
new file mode 100644
index 0000000000..9882c9f30a
--- /dev/null
+++ b/crates/aqua-registry/aqua-registry/pkgs/stackrox/stackrox/roxctl/registry.yaml
@@ -0,0 +1,33 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/registry.json
+packages:
+  - type: http
+    repo_owner: stackrox
+    repo_name: stackrox
+    name: stackrox/stackrox/roxctl
+    description: CLI for StackRox Kubernetes Security Platform
+    link: https://www.stackrox.io/
+    version_constraint: "false"
+    version_overrides:
+      - version_constraint: semver("<= 4.4.8")
+        url: https://mirror.openshift.com/pub/rhacs/assets/{{.Version}}/bin/{{.OS}}/roxctl
+        format: raw
+        supported_envs:
+          - linux/amd64
+          - darwin
+          - windows
+        checksum:
+          type: http
+          url: https://mirror.openshift.com/pub/rhacs/assets/{{.Version}}/bin/{{.OS}}/sha256sum.txt
+          algorithm: sha256
+      - version_constraint: "true"
+        url: https://mirror.openshift.com/pub/rhacs/assets/{{.Version}}/bin/{{.OS}}/roxctl
+        format: raw
+        overrides:
+          - goos: windows
+            url: https://mirror.openshift.com/pub/rhacs/assets/{{.Version}}/bin/windows/roxctl.exe
+          - goarch: arm64
+            url: https://mirror.openshift.com/pub/rhacs/assets/{{.Version}}/bin/{{.OS}}/roxctl-arm64
+        checksum:
+          type: http
+          url: https://mirror.openshift.com/pub/rhacs/assets/{{.Version}}/bin/{{.OS}}/sha256sum.txt
+          algorithm: sha256
diff --git a/default.nix b/default.nix
index 05604b24b2..e667667f46 100644
--- a/default.nix
+++ b/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage {
   pname = "mise";
-  version = "2026.3.6";
+  version = "2026.3.7";
 
   src = lib.cleanSource ./.;
 
diff --git a/packaging/rpm/mise.spec b/packaging/rpm/mise.spec
index eee99f038c..13f9dc48a5 100644
--- a/packaging/rpm/mise.spec
+++ b/packaging/rpm/mise.spec
@@ -1,6 +1,6 @@
 Summary: The front-end to your dev env
 Name: mise
-Version: 2026.3.6
+Version: 2026.3.7
 Release: 1
 URL: https://github.com/jdx/mise/
 Group: System
diff --git a/snapcraft.yaml b/snapcraft.yaml
index df397e4871..994498706d 100644
--- a/snapcraft.yaml
+++ b/snapcraft.yaml
@@ -9,7 +9,7 @@
 
 name: mise
 title: mise-en-place
-version: "2026.3.6"
+version: "2026.3.7"
 summary: The front-end to your dev env
 description: |
   mise-en-place is a command line tool to manage your development environment.