diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9d9b17..67cbfd6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       # glibc runner is the default; a `-musl` variant exists for Alpine.
-      image: ghcr.io/fulmenhq/goneat-tools-runner-glibc:v0.4.2
+      image: ghcr.io/fulmenhq/goneat-tools-runner-glibc:v0.5.2
       # actions/checkout@v4 needs write access to
       # /__w/_temp/_runner_file_commands/.
       options: --user root
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ff1850f..11fd02c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/fulmenhq/goneat-tools-runner-glibc:v0.4.2
+      image: ghcr.io/fulmenhq/goneat-tools-runner-glibc:v0.5.2
       options: --user root
     env:
       # CI-only boundary hint for repo-root discovery
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce91183..0efd569 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 - README provenance story describes the signed two-phase cut and the
   fingerprint-pin reviewer path.
+- CI and Release use `goneat-tools-runner-glibc:v0.5.2` (goneat `v0.5.16`).
+  Local `make` bootstrap pin matches.
+- Direct `spf13/pflag` patch `v1.0.9` → `v1.0.10`.
+- Indirect `fulmenhq/crucible` `v0.4.12` → `v0.4.18`.
 
 ## [0.1.3] - 2026-08-18
 
diff --git a/Makefile b/Makefile
index c9cf686..257f7b6 100644
--- a/Makefile
+++ b/Makefile
@@ -69,7 +69,7 @@ EMBEDDED_IDENTITY_DST := internal/assets/appidentity/app.yaml
 # Bump cadence: keep within a couple of minor releases of upstream goneat so
 # local installs (via sfetch) track the toolbox runner image. CI/release do not
 # use this — they get goneat from the goneat-tools-runner image.
-GONEAT_VERSION ?= v0.5.12
+GONEAT_VERSION ?= v0.5.16
 SFETCH_BIN := $(shell command -v sfetch 2>/dev/null)
 GONEAT_BIN = $(firstword $(wildcard $(BINDIR)/goneat$(BINARY_EXT)) $(shell command -v goneat 2>/dev/null))
 
diff --git a/docs/development/ci.md b/docs/development/ci.md
index f9023d4..92be242 100644
--- a/docs/development/ci.md
+++ b/docs/development/ci.md
@@ -1,6 +1,7 @@
 # CI
 
-Decernor uses GitHub Actions with the Fulmen goneat toolbox runner image.
+Decernor uses GitHub Actions with the Fulmen goneat toolbox runner image
+(`ghcr.io/fulmenhq/goneat-tools-runner-glibc:v0.5.2`, goneat `v0.5.16`).
 
 The CI workflow currently verifies:
 
diff --git a/go.mod b/go.mod
index b71f576..ba0642f 100644
--- a/go.mod
+++ b/go.mod
@@ -7,13 +7,13 @@ require (
 	github.com/fulmenhq/gofulmen v0.3.5
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
 	github.com/spf13/cobra v1.10.2
-	github.com/spf13/pflag v1.0.9
+	github.com/spf13/pflag v1.0.10
 	go.uber.org/zap v1.28.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/fulmenhq/crucible v0.4.12 // indirect
+	github.com/fulmenhq/crucible v0.4.18 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
diff --git a/go.sum b/go.sum
index db2b583..6202070 100644
--- a/go.sum
+++ b/go.sum
@@ -5,8 +5,8 @@ github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJ
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fulmenhq/crucible v0.4.12 h1:549xiM9n/bD6powggln/mWgftc+AQYVM10WuR4eZzLY=
-github.com/fulmenhq/crucible v0.4.12/go.mod h1:DiYbzatW+h/snWWNd7mBWg0mV+tHJHIvzi4oJakv79s=
+github.com/fulmenhq/crucible v0.4.18 h1:LBU15x8RotLvPhG3ZZyFA132YVZm9brn1Wc4fm6zld8=
+github.com/fulmenhq/crucible v0.4.18/go.mod h1:DiYbzatW+h/snWWNd7mBWg0mV+tHJHIvzi4oJakv79s=
 github.com/fulmenhq/gofulmen v0.3.5 h1:pYA27BU3I93lgyruMWUl/K7UtlLE4E+mOhFYRCPwFbo=
 github.com/fulmenhq/gofulmen v0.3.5/go.mod h1:zsc9tB8fR8P+uGn5/xgWEJYD1JEhbPJfyKk+/s9lDzs=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -24,8 +24,9 @@ github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6Ng
 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=