diff --git a/README.md b/README.md
index 429559f..54b9fea 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ Cross-platform dotfiles managed with [chezmoi](https://www.chezmoi.io/).
 | **Shell** | Fish, Zsh | PowerShell | — |
 | **Prompt** | — | — | Starship |
 | **Terminal** | Ghostty, iTerm2 | Windows Terminal (pwsh default) | — |
-| **Version mgmt** | — | — | mise (Python, Node) |
+| **Version mgmt** | — | — | mise (agent CLIs, Python, Node) |
 | **Editor** | — | — | VSCode, EditorConfig |
 | **Git** | 1Password SSH signing | Credential Manager | Common config |
 | **SSH** | 1Password agent (socket) | 1Password agent (named pipe) | — |
@@ -52,9 +52,33 @@ chezmoi cd                              # cd into source directory
 chezmoi add ~/.some/new/file            # start managing a new file
 ```
 
+### Coding-agent CLIs
+
+Claude Code, Codex, Grok Build, and OpenCode are installed and updated through
+mise on macOS, Windows, and Linux. Vendor self-updaters are disabled where
+present so mise remains the single update owner.
+
+```bash
+mise run agent-clis:outdated  # check for newer releases
+mise run agent-clis:update    # update all four CLIs
+```
+
+`chezmoi apply` installs missing versions when the tracked mise configuration
+changes; it does not upgrade an unchanged `latest` declaration. Upgrades are
+therefore explicit through the task above.
+
+T3 Code does not currently recognize mise-managed provider installations. Do
+not use its provider update action for these CLIs; update them through mise.
+
+When migrating an existing machine, first apply and verify `mise which claude`,
+`mise which codex`, `mise which grok`, and `mise which opencode`. Then remove any
+older Homebrew, npm, or vendor-native installations that could shadow the mise
+shims.
+
 ## How it works
 
 - Files are stored in chezmoi's source format (`dot_` prefix replaces leading `.`)
 - Files ending in `.tmpl` are [Go templates](https://www.chezmoi.io/user-guide/templating/) with OS-conditional logic
+- `modify_` templates manage individual settings in tool-owned config files without replacing the rest of the file
 - `.chezmoiignore` controls which files deploy on which OS
 - `fish_variables` is intentionally not managed — Fish manages it automatically; important variables are set in `config.fish`
diff --git a/dot_claude/modify_settings.json b/dot_claude/modify_settings.json
new file mode 100644
index 0000000..ee7d587
--- /dev/null
+++ b/dot_claude/modify_settings.json
@@ -0,0 +1,25 @@
+{{- /* chezmoi:modify-template */ -}}
+{{- $input := .chezmoi.stdin -}}
+{{- $output := "" -}}
+{{- if not $input -}}
+{{- $output = `{
+  "env": {
+    "DISABLE_UPDATES": "1"
+  }
+}` -}}
+{{- else if regexMatch `(?m)^\s*"DISABLE_UPDATES"\s*:` $input -}}
+{{- $output = ($input | replaceAllRegex `(?m)^(\s*)"DISABLE_UPDATES"\s*:\s*"[^"]*"(\s*,?)` `${1}"DISABLE_UPDATES": "1"${2}`) -}}
+{{- else if regexMatch `(?m)^\s*"env"\s*:\s*\{\s*\}` $input -}}
+{{- $output = ($input | replaceAllRegex `(?m)^(\s*)"env"\s*:\s*\{\s*\}` `${1}"env": {
+${1}  "DISABLE_UPDATES": "1"
+${1}}`) -}}
+{{- else if regexMatch `(?m)^\s*"env"\s*:\s*\{\s*$` $input -}}
+{{- $output = ($input | replaceAllRegex `(?m)^(\s*)("env"\s*:\s*\{\s*)$` `${1}${2}
+${1}  "DISABLE_UPDATES": "1",`) -}}
+{{- else -}}
+{{- $output = ($input | replaceAllRegex `(?s)^(\s*\{)` `${1}
+  "env": {
+    "DISABLE_UPDATES": "1"
+  },`) -}}
+{{- end -}}
+{{- printf "%s\n" ($output | trimSuffix "\n") -}}
diff --git a/dot_config/mise/config.toml b/dot_config/mise/config.toml
index 7452d30..334bc4c 100644
--- a/dot_config/mise/config.toml
+++ b/dot_config/mise/config.toml
@@ -1,9 +1,23 @@
 [tools]
+# Coding-agent CLIs use mise as their single install/update owner on every OS.
+# Registry backends: Aqua for Claude/Codex/OpenCode; xAI's HTTP releases for Grok.
+claude = "latest"
+codex = "latest"
+grok = "latest"
 node = "lts"
+opencode = "latest"
 python = "3.12"
 uv = "latest"
 
+[tasks."agent-clis:outdated"]
+description = "Check coding-agent CLIs for updates"
+run = "mise outdated claude codex grok opencode"
+
+[tasks."agent-clis:update"]
+description = "Update all coding-agent CLIs managed by mise"
+run = "mise upgrade claude codex grok opencode"
+
 [settings]
-python.uv_venv_auto = true  # auto-creates/activates .venv via uv
+python.uv_venv_auto = "create|source" # auto-creates/activates .venv via uv
 # Let per-repo rust-toolchain.toml drive the Rust version.
 idiomatic_version_file_enable_tools = ["rust"]
diff --git a/dot_config/opencode/modify_opencode.jsonc b/dot_config/opencode/modify_opencode.jsonc
new file mode 100644
index 0000000..b4a6c97
--- /dev/null
+++ b/dot_config/opencode/modify_opencode.jsonc
@@ -0,0 +1,15 @@
+{{- /* chezmoi:modify-template */ -}}
+{{- $input := .chezmoi.stdin -}}
+{{- $output := "" -}}
+{{- if not $input -}}
+{{- $output = `{
+  "$schema": "https://opencode.ai/config.json",
+  "autoupdate": false
+}` -}}
+{{- else if regexMatch `(?m)^\s*"autoupdate"\s*:` $input -}}
+{{- $output = ($input | replaceAllRegex `(?m)^(\s*)"autoupdate"\s*:\s*(?:true|false|"notify")(\s*,?)` `${1}"autoupdate": false${2}`) -}}
+{{- else -}}
+{{- $output = ($input | replaceAllRegex `(?s)^(\s*\{)` `${1}
+  "autoupdate": false,`) -}}
+{{- end -}}
+{{- printf "%s\n" ($output | trimSuffix "\n") -}}
diff --git a/dot_grok/modify_config.toml b/dot_grok/modify_config.toml
new file mode 100644
index 0000000..8e59b36
--- /dev/null
+++ b/dot_grok/modify_config.toml
@@ -0,0 +1,15 @@
+{{- /* chezmoi:modify-template */ -}}
+{{- $input := .chezmoi.stdin -}}
+{{- $output := "" -}}
+{{- if not $input -}}
+{{- $output = `[cli]
+auto_update = false` -}}
+{{- else if regexMatch `(?m)^\s*auto_update\s*=` $input -}}
+{{- $output = ($input | replaceAllRegex `(?m)^(\s*)auto_update\s*=\s*[^\r\n#]*(\s*(?:#.*)?)$` `${1}auto_update = false${2}`) -}}
+{{- else if regexMatch `(?m)^\s*\[cli\]\s*$` $input -}}
+{{- $output = ($input | replaceAllRegex `(?m)^(\s*\[cli\]\s*)$` `${1}
+auto_update = false`) -}}
+{{- else -}}
+{{- $output = printf "%s\n[cli]\nauto_update = false" ($input | trimSuffix "\n") -}}
+{{- end -}}
+{{- printf "%s\n" ($output | trimSuffix "\n") -}}