diff --git a/.envrc b/.envrc
deleted file mode 100644
index 80f2bf6..0000000
--- a/.envrc
+++ /dev/null
@@ -1,10 +0,0 @@
-watch_file .prototools
-watch_dir .moon/proto
-
-if ! command -v proto >/dev/null 2>&1; then
-  log_error "proto is required for this repository: https://moonrepo.dev/proto"
-  exit 1
-fi
-
-proto install --quiet
-eval "$(proto activate bash --export --no-init)"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 748269f..910c12e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,6 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    env:
+      # Never auto-download a Go toolchain other than the mise-pinned one
+      # (mise [env] is not carried by the action's shims, so set it on the job).
+      GOTOOLCHAIN: local
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -28,12 +32,13 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Moon Toolchain
-        uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
-          auto-install: true
-          auto-setup: true
-          cache-base: ${{ github.event.repository.default_branch }}
+          version: 2026.6.14
+          cache: true
+          # Installs every tool from mise.toml honoring mise.lock (locked → fail
+          # closed), including moon, and prepends the shim dir to PATH.
 
       - name: Cache Go modules
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -47,18 +52,18 @@ jobs:
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/go-build
-          key: ${{ runner.os }}-go-build-${{ hashFiles('.go-version', 'go.sum') }}-${{ github.run_id }}
+          key: ${{ runner.os }}-go-build-${{ hashFiles('mise.lock', 'go.sum') }}-${{ github.run_id }}
           restore-keys: |
-            ${{ runner.os }}-go-build-${{ hashFiles('.go-version', 'go.sum') }}-
+            ${{ runner.os }}-go-build-${{ hashFiles('mise.lock', 'go.sum') }}-
             ${{ runner.os }}-go-build-
 
       - name: Cache golangci-lint
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/golangci-lint
-          key: ${{ runner.os }}-golangci-lint-${{ hashFiles('.go-version', '.golangci.yml', '.prototools', '.moon/proto/golangci-lint.toml', 'go.sum') }}-${{ github.run_id }}
+          key: ${{ runner.os }}-golangci-lint-${{ hashFiles('mise.lock', '.golangci.yml', 'go.sum') }}-${{ github.run_id }}
           restore-keys: |
-            ${{ runner.os }}-golangci-lint-${{ hashFiles('.go-version', '.golangci.yml', '.prototools', '.moon/proto/golangci-lint.toml', 'go.sum') }}-
+            ${{ runner.os }}-golangci-lint-${{ hashFiles('mise.lock', '.golangci.yml', 'go.sum') }}-
             ${{ runner.os }}-golangci-lint-
 
       - name: Run static checks
diff --git a/.github/workflows/release-dry-run.yml b/.github/workflows/release-dry-run.yml
index dd7705d..a54edae 100644
--- a/.github/workflows/release-dry-run.yml
+++ b/.github/workflows/release-dry-run.yml
@@ -37,7 +37,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
           cache: true
 
       - name: Install Syft
@@ -258,12 +258,11 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Set up Moon toolchain
-        uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
-          auto-install: true
-          auto-setup: true
-          cache-base: ${{ github.event.repository.default_branch }}
+          version: 2026.6.14
+          cache: true
 
       - name: Package chart without publishing
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cbfd4cf..f501f1f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
           cache: true
 
       - name: Install Syft
@@ -428,12 +428,11 @@ jobs:
           RELEASE_TAG: ${{ needs.resolve-release.outputs.tag }}
         run: git checkout --detach "$RELEASE_TAG"
 
-      - name: Set up Moon toolchain
-        uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
-          auto-install: true
-          auto-setup: true
-          cache-base: ${{ github.event.repository.default_branch }}
+          version: 2026.6.14
+          cache: true
 
       - name: Package Helm chart
         id: package-chart
diff --git a/.go-version b/.go-version
deleted file mode 100644
index f8f7381..0000000
--- a/.go-version
+++ /dev/null
@@ -1 +0,0 @@
-1.26.3
diff --git a/.moon/proto/chainsaw.toml b/.moon/proto/chainsaw.toml
deleted file mode 100644
index 2771293..0000000
--- a/.moon/proto/chainsaw.toml
+++ /dev/null
@@ -1,31 +0,0 @@
-name = "chainsaw"
-type = "cli"
-
-[platform.macos]
-download-file = "chainsaw_darwin_{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "chainsaw"
-
-[platform.linux]
-download-file = "chainsaw_linux_{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "chainsaw"
-
-[platform.windows]
-download-file = "chainsaw_windows_{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "chainsaw.exe"
-
-[install]
-download-url = "https://github.com/kyverno/chainsaw/releases/download/v{version}/{download_file}"
-checksum-url = "https://github.com/kyverno/chainsaw/releases/download/v{version}/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.chainsaw]
-primary = true
-
-[resolve]
-git-url = "https://github.com/kyverno/chainsaw"
diff --git a/.moon/proto/controller-gen.toml b/.moon/proto/controller-gen.toml
deleted file mode 100644
index a0d2b9c..0000000
--- a/.moon/proto/controller-gen.toml
+++ /dev/null
@@ -1,28 +0,0 @@
-name = "controller-gen"
-type = "cli"
-
-[platform.macos]
-download-file = "controller-gen-darwin-{arch}"
-exe-path = "controller-gen"
-
-[platform.linux]
-download-file = "controller-gen-linux-{arch}"
-exe-path = "controller-gen"
-
-[platform.windows]
-download-file = "controller-gen-windows-{arch}.exe"
-exe-path = "controller-gen"
-
-[install]
-download-url = "https://github.com/kubernetes-sigs/controller-tools/releases/download/v{version}/{download_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.controller-gen]
-exe-path = "controller-gen"
-primary = true
-
-[resolve]
-git-url = "https://github.com/kubernetes-sigs/controller-tools"
diff --git a/.moon/proto/ctlptl.toml b/.moon/proto/ctlptl.toml
deleted file mode 100644
index 01a24d5..0000000
--- a/.moon/proto/ctlptl.toml
+++ /dev/null
@@ -1,30 +0,0 @@
-name = "ctlptl"
-type = "cli"
-
-[platform.macos]
-download-file = "ctlptl.{version}.mac.{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "ctlptl"
-
-[platform.linux]
-download-file = "ctlptl.{version}.linux.{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "ctlptl"
-
-[platform.windows]
-download-file = "ctlptl.{version}.windows.{arch}.zip"
-checksum-file = "checksums.txt"
-exe-path = "ctlptl.exe"
-
-[install]
-download-url = "https://github.com/tilt-dev/ctlptl/releases/download/v{version}/{download_file}"
-checksum-url = "https://github.com/tilt-dev/ctlptl/releases/download/v{version}/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-
-[install.exes.ctlptl]
-primary = true
-
-[resolve]
-git-url = "https://github.com/tilt-dev/ctlptl"
diff --git a/.moon/proto/golangci-lint.toml b/.moon/proto/golangci-lint.toml
deleted file mode 100644
index b233c97..0000000
--- a/.moon/proto/golangci-lint.toml
+++ /dev/null
@@ -1,31 +0,0 @@
-name = "golangci-lint"
-type = "cli"
-
-[platform.macos]
-download-file = "golangci-lint-{version}-darwin-{arch}.tar.gz"
-checksum-file = "golangci-lint-{version}-checksums.txt"
-exe-path = "golangci-lint-{version}-darwin-{arch}/golangci-lint"
-
-[platform.linux]
-download-file = "golangci-lint-{version}-linux-{arch}.tar.gz"
-checksum-file = "golangci-lint-{version}-checksums.txt"
-exe-path = "golangci-lint-{version}-linux-{arch}/golangci-lint"
-
-[platform.windows]
-download-file = "golangci-lint-{version}-windows-{arch}.zip"
-checksum-file = "golangci-lint-{version}-checksums.txt"
-exe-path = "golangci-lint-{version}-windows-{arch}/golangci-lint.exe"
-
-[install]
-download-url = "https://github.com/golangci/golangci-lint/releases/download/v{version}/{download_file}"
-checksum-url = "https://github.com/golangci/golangci-lint/releases/download/v{version}/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.golangci-lint]
-primary = true
-
-[resolve]
-git-url = "https://github.com/golangci/golangci-lint"
diff --git a/.moon/proto/helm.toml b/.moon/proto/helm.toml
deleted file mode 100644
index 93ebaab..0000000
--- a/.moon/proto/helm.toml
+++ /dev/null
@@ -1,31 +0,0 @@
-name = "helm"
-type = "cli"
-
-[platform.macos]
-download-file = "helm-v{version}-darwin-{arch}.tar.gz"
-checksum-file = "helm-v{version}-darwin-{arch}.tar.gz.sha256sum"
-exe-path = "darwin-{arch}/helm"
-
-[platform.linux]
-download-file = "helm-v{version}-linux-{arch}.tar.gz"
-checksum-file = "helm-v{version}-linux-{arch}.tar.gz.sha256sum"
-exe-path = "linux-{arch}/helm"
-
-[platform.windows]
-download-file = "helm-v{version}-windows-{arch}.zip"
-checksum-file = "helm-v{version}-windows-{arch}.zip.sha256sum"
-exe-path = "windows-{arch}/helm.exe"
-
-[install]
-download-url = "https://get.helm.sh/{download_file}"
-checksum-url = "https://get.helm.sh/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.helm]
-primary = true
-
-[resolve]
-git-url = "https://github.com/helm/helm"
diff --git a/.moon/proto/kind.toml b/.moon/proto/kind.toml
deleted file mode 100644
index 0759eab..0000000
--- a/.moon/proto/kind.toml
+++ /dev/null
@@ -1,32 +0,0 @@
-name = "kind"
-type = "cli"
-
-[platform.macos]
-download-file = "kind-darwin-{arch}"
-checksum-file = "kind-darwin-{arch}.sha256sum"
-exe-path = "kind"
-
-[platform.linux]
-download-file = "kind-linux-{arch}"
-checksum-file = "kind-linux-{arch}.sha256sum"
-exe-path = "kind"
-
-[platform.windows]
-download-file = "kind-windows-{arch}"
-checksum-file = "kind-windows-{arch}.sha256sum"
-exe-path = "kind"
-
-[install]
-download-url = "https://github.com/kubernetes-sigs/kind/releases/download/v{version}/{download_file}"
-checksum-url = "https://github.com/kubernetes-sigs/kind/releases/download/v{version}/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.kind]
-exe-path = "kind"
-primary = true
-
-[resolve]
-git-url = "https://github.com/kubernetes-sigs/kind"
diff --git a/.moon/proto/ko.toml b/.moon/proto/ko.toml
deleted file mode 100644
index 95eccde..0000000
--- a/.moon/proto/ko.toml
+++ /dev/null
@@ -1,30 +0,0 @@
-name = "ko"
-type = "cli"
-
-[platform.macos]
-download-file = "ko_{version}_Darwin_{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "ko"
-
-[platform.linux]
-download-file = "ko_{version}_Linux_{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "ko"
-
-[platform.windows]
-download-file = "ko_{version}_Windows_{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "ko.exe"
-
-[install]
-download-url = "https://github.com/ko-build/ko/releases/download/v{version}/{download_file}"
-checksum-url = "https://github.com/ko-build/ko/releases/download/v{version}/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-
-[install.exes.ko]
-primary = true
-
-[resolve]
-git-url = "https://github.com/ko-build/ko"
diff --git a/.moon/proto/kubebuilder.toml b/.moon/proto/kubebuilder.toml
deleted file mode 100644
index 670504e..0000000
--- a/.moon/proto/kubebuilder.toml
+++ /dev/null
@@ -1,27 +0,0 @@
-name = "kubebuilder"
-type = "cli"
-
-[platform.macos]
-download-file = "kubebuilder_darwin_{arch}"
-checksum-file = "checksums.txt"
-exe-path = "kubebuilder"
-
-[platform.linux]
-download-file = "kubebuilder_linux_{arch}"
-checksum-file = "checksums.txt"
-exe-path = "kubebuilder"
-
-[install]
-checksum-url = "https://github.com/kubernetes-sigs/kubebuilder/releases/download/v{version}/{checksum_file}"
-download-url = "https://github.com/kubernetes-sigs/kubebuilder/releases/download/v{version}/{download_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.kubebuilder]
-exe-path = "kubebuilder"
-primary = true
-
-[resolve]
-git-url = "https://github.com/kubernetes-sigs/kubebuilder"
diff --git a/.moon/proto/kubectl.toml b/.moon/proto/kubectl.toml
deleted file mode 100644
index e807b61..0000000
--- a/.moon/proto/kubectl.toml
+++ /dev/null
@@ -1,32 +0,0 @@
-name = "kubectl"
-type = "cli"
-
-[platform.macos]
-download-file = "bin/darwin/{arch}/kubectl"
-checksum-file = "bin/darwin/{arch}/kubectl.sha256"
-exe-path = "kubectl"
-
-[platform.linux]
-download-file = "bin/linux/{arch}/kubectl"
-checksum-file = "bin/linux/{arch}/kubectl.sha256"
-exe-path = "kubectl"
-
-[platform.windows]
-download-file = "bin/windows/{arch}/kubectl.exe"
-checksum-file = "bin/windows/{arch}/kubectl.exe.sha256"
-exe-path = "kubectl"
-
-[install]
-download-url = "https://dl.k8s.io/release/v{version}/{download_file}"
-checksum-url = "https://dl.k8s.io/release/v{version}/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.kubectl]
-exe-path = "kubectl"
-primary = true
-
-[resolve]
-git-url = "https://github.com/kubernetes/kubernetes"
diff --git a/.moon/proto/setup-envtest.toml b/.moon/proto/setup-envtest.toml
deleted file mode 100644
index 655595b..0000000
--- a/.moon/proto/setup-envtest.toml
+++ /dev/null
@@ -1,28 +0,0 @@
-name = "setup-envtest"
-type = "cli"
-
-[platform.macos]
-download-file = "setup-envtest-darwin-{arch}"
-exe-path = "setup-envtest"
-
-[platform.linux]
-download-file = "setup-envtest-linux-{arch}"
-exe-path = "setup-envtest"
-
-[platform.windows]
-download-file = "setup-envtest-windows-{arch}.exe"
-exe-path = "setup-envtest"
-
-[install]
-download-url = "https://github.com/kubernetes-sigs/controller-runtime/releases/download/v{version}/{download_file}"
-
-[install.arch]
-aarch64 = "arm64"
-x86_64 = "amd64"
-
-[install.exes.setup-envtest]
-exe-path = "setup-envtest"
-primary = true
-
-[resolve]
-git-url = "https://github.com/kubernetes-sigs/controller-runtime"
diff --git a/.moon/proto/tilt.toml b/.moon/proto/tilt.toml
deleted file mode 100644
index dc70d43..0000000
--- a/.moon/proto/tilt.toml
+++ /dev/null
@@ -1,30 +0,0 @@
-name = "tilt"
-type = "cli"
-
-[platform.macos]
-download-file = "tilt.{version}.mac.{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "tilt"
-
-[platform.linux]
-download-file = "tilt.{version}.linux.{arch}.tar.gz"
-checksum-file = "checksums.txt"
-exe-path = "tilt"
-
-[platform.windows]
-download-file = "tilt.{version}.windows.{arch}.zip"
-checksum-file = "checksums.txt"
-exe-path = "tilt.exe"
-
-[install]
-download-url = "https://github.com/tilt-dev/tilt/releases/download/v{version}/{download_file}"
-checksum-url = "https://github.com/tilt-dev/tilt/releases/download/v{version}/{checksum_file}"
-
-[install.arch]
-aarch64 = "arm64"
-
-[install.exes.tilt]
-primary = true
-
-[resolve]
-git-url = "https://github.com/tilt-dev/tilt"
diff --git a/.moon/toolchains.yml b/.moon/toolchains.yml
index 9a2a6be..3327305 100644
--- a/.moon/toolchains.yml
+++ b/.moon/toolchains.yml
@@ -1,2 +1,12 @@
-go:
-  version: '1.26.3'
+# Toolchains for the template-k8s operator.
+#
+# Tool versions (Go and every CLI) are managed by mise (mise.toml + mise.lock);
+# moon runs every task against `system` binaries that mise puts on PATH (see
+# `toolchains.default: system` in moon.yml), so no language toolchain is declared
+# here.
+
+# Stable non-JavaScript toolchains in Moon v2 can be added if a generated project
+# needs moon to manage them directly instead of mise.
+# rust:
+#   version: 'REPLACE_ME_RUST_VERSION'
+#   components: ['clippy', 'rustfmt']
diff --git a/.prototools b/.prototools
deleted file mode 100644
index 061b488..0000000
--- a/.prototools
+++ /dev/null
@@ -1,24 +0,0 @@
-kubebuilder = "=4.14.0"
-golangci-lint = "=2.11.4"
-controller-gen = "=0.21.0"
-setup-envtest = "=0.24.1"
-kubectl = "=1.35.5"
-helm = "=4.0.4"
-chainsaw = "=0.2.15"
-tilt = "=0.37.3"
-ko = "=0.18.1"
-kind = "=0.31.0"
-ctlptl = "=0.9.3"
-
-[plugins.tools]
-kubebuilder = "file://.moon/proto/kubebuilder.toml"
-golangci-lint = "file://.moon/proto/golangci-lint.toml"
-controller-gen = "file://.moon/proto/controller-gen.toml"
-setup-envtest = "file://.moon/proto/setup-envtest.toml"
-kubectl = "file://.moon/proto/kubectl.toml"
-helm = "file://.moon/proto/helm.toml"
-chainsaw = "file://.moon/proto/chainsaw.toml"
-tilt = "file://.moon/proto/tilt.toml"
-ko = "file://.moon/proto/ko.toml"
-kind = "file://.moon/proto/kind.toml"
-ctlptl = "file://.moon/proto/ctlptl.toml"
diff --git a/AGENTS.md b/AGENTS.md
index 2f15b9d..6dd3a7e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,9 +32,15 @@ expects agents to follow.
 
 ## Development Workflow
 
-Moon is the task front door. Do not add or restore Makefile-driven workflows.
-If upstream Kubebuilder docs say to run `make`, translate the step to the
-matching Moon task.
+mise is the tool front door: it provisions every pinned binary (Go, Moon, and
+the operator/dev/release CLIs) from `mise.toml` + `mise.lock`. Run `mise install`
+once; do not restore the removed Proto config (`.prototools`, `.moon/proto/`) or
+`.envrc`. Bump a tool by editing `mise.toml` and re-running
+`mise lock --platform linux-x64,linux-arm64,macos-x64,macos-arm64`.
+
+Moon is the task front door, and runs those tools as `system` binaries. Do not
+add or restore Makefile-driven workflows. If upstream Kubebuilder docs say to run
+`make`, translate the step to the matching Moon task.
 
 Keep the Moon task surface small. Prefer extending `root:check`, `root:test`,
 or an existing script over adding narrowly scoped recipes. Add a new Moon task
@@ -61,7 +67,7 @@ Use the local dev stack when you need a fast operator feedback loop in Kind.
 Run it through Moon from the repo root:
 
 ```sh
-direnv allow
+mise install
 moon run root:dev-up
 moon run root:dev-down
 ```
diff --git a/README.md b/README.md
index 88958cb..025331a 100644
--- a/README.md
+++ b/README.md
@@ -29,18 +29,22 @@ Replace bracketed placeholders before publishing this README.
 
 ## Prerequisites
 
-- Go, Kubebuilder tooling, controller-gen, setup-envtest, Helm, kubectl, and
-  Chainsaw from the repository toolchain.
+- [mise](https://mise.jdx.dev) — provisions every pinned tool from `mise.toml` +
+  `mise.lock`: Go, Moon, the Kubebuilder operator CLIs (`controller-gen`,
+  `setup-envtest`, `kubebuilder`, `kubectl`, `helm`, `chainsaw`), the local dev
+  stack (`ko`, `tilt`, `ctlptl`, `kind`), and `melange`/`apko`/`cosign` for the
+  release image. Run `mise install` once; there is nothing else to install by hand.
 - Docker or another container runtime for local image builds.
 - A Kubernetes cluster for deployed testing. Kind is recommended for local e2e
   checks.
 
-Enable the pinned local toolchain:
-
-```sh
-direnv allow
-proto status
-```
+Tool versions live in `mise.toml`; `mise.lock` records a per-platform download URL
+and checksum for each (and, for the aqua-backed CLIs, cosign/SLSA/GitHub-attestation
+verification). `mise install` runs with `locked = true`, so it **fails closed** if a
+tool lacks a pre-resolved, checksummed entry for the current platform. To bump a
+tool, edit its version in `mise.toml`, run
+`mise lock --platform linux-x64,linux-arm64,macos-x64,macos-arm64`, and commit
+`mise.toml` + `mise.lock` together.
 
 ## Installation
 
diff --git a/mise.lock b/mise.lock
new file mode 100644
index 0000000..f427694
--- /dev/null
+++ b/mise.lock
@@ -0,0 +1,340 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools."aqua:chainguard-dev/apko"]]
+version = "1.2.19"
+backend = "aqua:chainguard-dev/apko"
+
+[tools."aqua:chainguard-dev/apko"."platforms.linux-arm64"]
+checksum = "sha256:d1ba1cb5028a58b080e8ae1c168b67bb363b1a5029069c4ac1394951796db7d6"
+url = "https://github.com/chainguard-dev/apko/releases/download/v1.2.19/apko_1.2.19_linux_arm64.tar.gz"
+
+[tools."aqua:chainguard-dev/apko"."platforms.linux-x64"]
+checksum = "sha256:86c7c860ed0b429f9dba0317d4646d382503280f6d8bb7f568a3934515b01b04"
+url = "https://github.com/chainguard-dev/apko/releases/download/v1.2.19/apko_1.2.19_linux_amd64.tar.gz"
+
+[tools."aqua:chainguard-dev/apko"."platforms.macos-arm64"]
+checksum = "sha256:1aaf12b7440d772934ca860102675780a9fa7dbbd9769c2b731977932d9d6762"
+url = "https://github.com/chainguard-dev/apko/releases/download/v1.2.19/apko_1.2.19_darwin_arm64.tar.gz"
+
+[tools."aqua:chainguard-dev/apko"."platforms.macos-x64"]
+checksum = "sha256:98cb42ce222b0e0aa856fdc7ec0bba55b7866810f7067772eb9f03faa1378228"
+url = "https://github.com/chainguard-dev/apko/releases/download/v1.2.19/apko_1.2.19_darwin_amd64.tar.gz"
+
+[[tools."aqua:chainguard-dev/melange"]]
+version = "0.54.0"
+backend = "aqua:chainguard-dev/melange"
+
+[tools."aqua:chainguard-dev/melange"."platforms.linux-arm64"]
+checksum = "sha256:1c1dc145c473adaf86ab52d18b0f748db2dcc299005886d1c00135bea65c9310"
+url = "https://github.com/chainguard-dev/melange/releases/download/v0.54.0/melange_0.54.0_linux_arm64.tar.gz"
+
+[tools."aqua:chainguard-dev/melange"."platforms.linux-x64"]
+checksum = "sha256:1c25b9c1bc2f862e32a5f8bac47c9993dcb5a11051b5295e724e95426d3b6bd4"
+url = "https://github.com/chainguard-dev/melange/releases/download/v0.54.0/melange_0.54.0_linux_amd64.tar.gz"
+
+[tools."aqua:chainguard-dev/melange"."platforms.macos-arm64"]
+checksum = "sha256:4402934be1032c3a265dcf41dde097b825017664e295b85182695f39f2d92c4e"
+url = "https://github.com/chainguard-dev/melange/releases/download/v0.54.0/melange_0.54.0_darwin_arm64.tar.gz"
+
+[tools."aqua:chainguard-dev/melange"."platforms.macos-x64"]
+checksum = "sha256:e7b44654803809bf9f79daec70097bbede9a5d33c1d925888ef1e19d5b4cb1a7"
+url = "https://github.com/chainguard-dev/melange/releases/download/v0.54.0/melange_0.54.0_darwin_amd64.tar.gz"
+
+[[tools."aqua:golangci/golangci-lint"]]
+version = "2.11.4"
+backend = "aqua:golangci/golangci-lint"
+
+[tools."aqua:golangci/golangci-lint"."platforms.linux-arm64"]
+checksum = "sha256:3bcfa2e6f3d32b2bf5cd75eaa876447507025e0303698633f722a05331988db4"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-linux-arm64.tar.gz"
+provenance = "github-attestations"
+
+[tools."aqua:golangci/golangci-lint"."platforms.linux-x64"]
+checksum = "sha256:200c5b7503f67b59a6743ccf32133026c174e272b930ee79aa2aa6f37aca7ef1"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-linux-amd64.tar.gz"
+provenance = "github-attestations"
+
+[tools."aqua:golangci/golangci-lint"."platforms.macos-arm64"]
+checksum = "sha256:02db2a2dae8b26812e53b0688a6f617e3ef1f489790e829ea22862cf76945675"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-darwin-arm64.tar.gz"
+provenance = "github-attestations"
+
+[tools."aqua:golangci/golangci-lint"."platforms.macos-x64"]
+checksum = "sha256:c900d4048db75d1edfd550fd11cf6a9b3008e7caa8e119fcddbc700412d63e60"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.4/golangci-lint-2.11.4-darwin-amd64.tar.gz"
+provenance = "github-attestations"
+
+[[tools."aqua:helm/helm"]]
+version = "4.0.4"
+backend = "aqua:helm/helm"
+
+[tools."aqua:helm/helm"."platforms.linux-arm64"]
+checksum = "sha256:16b88acc6503d646b7537a298e7389bef469c5cc9ebadf727547abe9f6a35903"
+url = "https://get.helm.sh/helm-v4.0.4-linux-arm64.tar.gz"
+
+[tools."aqua:helm/helm"."platforms.linux-x64"]
+checksum = "sha256:29454bc351f4433e66c00f5d37841627cbbcc02e4c70a6d796529d355237671c"
+url = "https://get.helm.sh/helm-v4.0.4-linux-amd64.tar.gz"
+
+[tools."aqua:helm/helm"."platforms.macos-arm64"]
+checksum = "sha256:a7ea99937a9679b3935fa0a2b70e577aa1ea84e5856e7c0821ca6ffa064ea976"
+url = "https://get.helm.sh/helm-v4.0.4-darwin-arm64.tar.gz"
+
+[tools."aqua:helm/helm"."platforms.macos-x64"]
+checksum = "sha256:73bcfd6ab000fdc95acf9fe1c59e8e47179426a653e45ae485889869d4a00523"
+url = "https://get.helm.sh/helm-v4.0.4-darwin-amd64.tar.gz"
+
+[[tools."aqua:ko-build/ko"]]
+version = "0.18.1"
+backend = "aqua:ko-build/ko"
+
+[tools."aqua:ko-build/ko"."platforms.linux-arm64"]
+checksum = "sha256:9a26698876892128952fa3d038a4e99bea961d0d225865c60474b79e3db12e99"
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/ko_0.18.1_Linux_arm64.tar.gz"
+
+[tools."aqua:ko-build/ko"."platforms.linux-arm64".provenance.slsa]
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/multiple.intoto.jsonl"
+
+[tools."aqua:ko-build/ko"."platforms.linux-x64"]
+checksum = "sha256:048ab11818089a43b7b74bc554494a79a3fd0d9822c061142e5cd3cf8b30cb27"
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/ko_0.18.1_Linux_x86_64.tar.gz"
+
+[tools."aqua:ko-build/ko"."platforms.linux-x64".provenance.slsa]
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/multiple.intoto.jsonl"
+
+[tools."aqua:ko-build/ko"."platforms.macos-arm64"]
+checksum = "sha256:752a639e0fbc013a35a43974b5ed87e7008bc2aee4952dfd2cc19f0013205492"
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/ko_0.18.1_Darwin_arm64.tar.gz"
+
+[tools."aqua:ko-build/ko"."platforms.macos-arm64".provenance.slsa]
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/multiple.intoto.jsonl"
+
+[tools."aqua:ko-build/ko"."platforms.macos-x64"]
+checksum = "sha256:0e0dd8fddbefebb8572ece4dca8f07a7472de862fedd7e9845fd9d651e0d5dbe"
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/ko_0.18.1_Darwin_x86_64.tar.gz"
+
+[tools."aqua:ko-build/ko"."platforms.macos-x64".provenance.slsa]
+url = "https://github.com/ko-build/ko/releases/download/v0.18.1/multiple.intoto.jsonl"
+
+[[tools."aqua:kubernetes-sigs/controller-runtime/setup-envtest"]]
+version = "0.24.1"
+backend = "aqua:kubernetes-sigs/controller-runtime/setup-envtest"
+
+[tools."aqua:kubernetes-sigs/controller-runtime/setup-envtest"."platforms.linux-arm64"]
+checksum = "sha256:c5d8968ec3f2a120b66bc13bd36f80fe4150c34aae7cc491bf9624c8680296c7"
+url = "https://github.com/kubernetes-sigs/controller-runtime/releases/download/v0.24.1/setup-envtest-linux-arm64"
+
+[tools."aqua:kubernetes-sigs/controller-runtime/setup-envtest"."platforms.linux-x64"]
+checksum = "sha256:a9a78fadfc338a38188332f36863c76877f1c86df1a83d2241d2bfc3935297d2"
+url = "https://github.com/kubernetes-sigs/controller-runtime/releases/download/v0.24.1/setup-envtest-linux-amd64"
+
+[tools."aqua:kubernetes-sigs/controller-runtime/setup-envtest"."platforms.macos-arm64"]
+checksum = "sha256:7e59a0d526f6946aa2f114d34b2e309639c811f3a4f83d56f37b6e3197c6fdfb"
+url = "https://github.com/kubernetes-sigs/controller-runtime/releases/download/v0.24.1/setup-envtest-darwin-arm64"
+
+[tools."aqua:kubernetes-sigs/controller-runtime/setup-envtest"."platforms.macos-x64"]
+checksum = "sha256:3fb17f2b1b0f09b7e5395180bd2bcb1d53bb78d72bb0415106b7ae8bf64e23d0"
+url = "https://github.com/kubernetes-sigs/controller-runtime/releases/download/v0.24.1/setup-envtest-darwin-amd64"
+
+[[tools."aqua:kubernetes-sigs/kind"]]
+version = "0.31.0"
+backend = "aqua:kubernetes-sigs/kind"
+
+[tools."aqua:kubernetes-sigs/kind"."platforms.linux-arm64"]
+checksum = "sha256:8e1014e87c34901cc422a1445866835d1e666f2a61301c27e722bdeab5a1f7e4"
+url = "https://github.com/kubernetes-sigs/kind/releases/download/v0.31.0/kind-linux-arm64"
+
+[tools."aqua:kubernetes-sigs/kind"."platforms.linux-x64"]
+checksum = "sha256:eb244cbafcc157dff60cf68693c14c9a75c4e6e6fedaf9cd71c58117cb93e3fa"
+url = "https://github.com/kubernetes-sigs/kind/releases/download/v0.31.0/kind-linux-amd64"
+
+[tools."aqua:kubernetes-sigs/kind"."platforms.macos-arm64"]
+checksum = "sha256:88bf554fe9da6311c9f8c2d082613c002911a476f6b5090e9420b35d84e70c5c"
+url = "https://github.com/kubernetes-sigs/kind/releases/download/v0.31.0/kind-darwin-arm64"
+
+[tools."aqua:kubernetes-sigs/kind"."platforms.macos-x64"]
+checksum = "sha256:a8b3cf77b2ad77aec5bf710d1a2589d9117576132af812885cad41e9dede4d4e"
+url = "https://github.com/kubernetes-sigs/kind/releases/download/v0.31.0/kind-darwin-amd64"
+
+[[tools."aqua:kubernetes-sigs/kubebuilder"]]
+version = "4.14.0"
+backend = "aqua:kubernetes-sigs/kubebuilder"
+
+[tools."aqua:kubernetes-sigs/kubebuilder"."platforms.linux-arm64"]
+checksum = "sha256:da3682be7262ce1b099f21c4de11e2b26abdf4ed73bc9c5cc074764484051299"
+url = "https://github.com/kubernetes-sigs/kubebuilder/releases/download/v4.14.0/kubebuilder_linux_arm64"
+
+[tools."aqua:kubernetes-sigs/kubebuilder"."platforms.linux-x64"]
+checksum = "sha256:a433730088e4890b138c06e2362163cde459622b72eeccf61955f22de86fca86"
+url = "https://github.com/kubernetes-sigs/kubebuilder/releases/download/v4.14.0/kubebuilder_linux_amd64"
+
+[tools."aqua:kubernetes-sigs/kubebuilder"."platforms.macos-arm64"]
+checksum = "sha256:0c1eb2ac13f49e42392e03924a51d8f780110874aa512bd1283f068ff1af3c41"
+url = "https://github.com/kubernetes-sigs/kubebuilder/releases/download/v4.14.0/kubebuilder_darwin_arm64"
+
+[tools."aqua:kubernetes-sigs/kubebuilder"."platforms.macos-x64"]
+checksum = "sha256:e8ccc09675edc396b7c0219e6ba1c4a9c9ea209932d57cdeb6f38599a81aff26"
+url = "https://github.com/kubernetes-sigs/kubebuilder/releases/download/v4.14.0/kubebuilder_darwin_amd64"
+
+[[tools."aqua:kubernetes/kubernetes/kubectl"]]
+version = "1.35.5"
+backend = "aqua:kubernetes/kubernetes/kubectl"
+
+[tools."aqua:kubernetes/kubernetes/kubectl"."platforms.linux-arm64"]
+checksum = "sha256:ac69e06fd6860d69786692f5af1c3a1208ed54f8366a4d97ab15c172e99765ee"
+url = "https://dl.k8s.io/v1.35.5/bin/linux/arm64/kubectl"
+
+[tools."aqua:kubernetes/kubernetes/kubectl"."platforms.linux-x64"]
+checksum = "sha256:90f75ea6ecc9ea5633262e1c0b83a40560003b30fc94a04cb099404fcef0c224"
+url = "https://dl.k8s.io/v1.35.5/bin/linux/amd64/kubectl"
+
+[tools."aqua:kubernetes/kubernetes/kubectl"."platforms.macos-arm64"]
+checksum = "sha256:4d79aa4ca3015d6c70ac593d8c387efe09f4000b5ff1098f42610e6030a8ccb3"
+url = "https://dl.k8s.io/v1.35.5/bin/darwin/arm64/kubectl"
+
+[tools."aqua:kubernetes/kubernetes/kubectl"."platforms.macos-x64"]
+checksum = "sha256:d6af0a35e78865ab3352a3f76e7346041f6657d08641db1c1e93830210fce334"
+url = "https://dl.k8s.io/v1.35.5/bin/darwin/amd64/kubectl"
+
+[[tools."aqua:kyverno/chainsaw"]]
+version = "0.2.15"
+backend = "aqua:kyverno/chainsaw"
+
+[tools."aqua:kyverno/chainsaw"."platforms.linux-arm64"]
+checksum = "sha256:fecf5f3ea74d11da2cd5d95a4c016d5d2543cbc4844ce21adf5e727e7ffd9e44"
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/chainsaw_linux_arm64.tar.gz"
+
+[tools."aqua:kyverno/chainsaw"."platforms.linux-arm64".provenance.slsa]
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/multiple.intoto.jsonl"
+
+[tools."aqua:kyverno/chainsaw"."platforms.linux-x64"]
+checksum = "sha256:295d226c89f126c0a97775d364be149f47a810c8a3f9829ee410583d0c1abe3c"
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/chainsaw_linux_amd64.tar.gz"
+
+[tools."aqua:kyverno/chainsaw"."platforms.linux-x64".provenance.slsa]
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/multiple.intoto.jsonl"
+
+[tools."aqua:kyverno/chainsaw"."platforms.macos-arm64"]
+checksum = "sha256:502bef17dd822217e82590e9ccf01c1e26a56b3fa34a835789b9af73e82a169a"
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/chainsaw_darwin_arm64.tar.gz"
+
+[tools."aqua:kyverno/chainsaw"."platforms.macos-arm64".provenance.slsa]
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/multiple.intoto.jsonl"
+
+[tools."aqua:kyverno/chainsaw"."platforms.macos-x64"]
+checksum = "sha256:ddb56002ff8c6265f55ec40c82eb0ef0dddec5127dd12d4fc5e7953453481f4b"
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/chainsaw_darwin_amd64.tar.gz"
+
+[tools."aqua:kyverno/chainsaw"."platforms.macos-x64".provenance.slsa]
+url = "https://github.com/kyverno/chainsaw/releases/download/v0.2.15/multiple.intoto.jsonl"
+
+[[tools."aqua:moonrepo/moon"]]
+version = "2.3.5"
+backend = "aqua:moonrepo/moon"
+
+[tools."aqua:moonrepo/moon"."platforms.linux-arm64"]
+checksum = "sha256:553c2ed2202a0f2376cd21d49cd6436d8ff1cbbce537b2d97681adf7beaca61e"
+url = "https://github.com/moonrepo/moon/releases/download/v2.3.5/moon_cli-aarch64-unknown-linux-musl.tar.xz"
+
+[tools."aqua:moonrepo/moon"."platforms.linux-x64"]
+checksum = "sha256:5639b8780dc4281776524a48f645b814754f8a5373c3d3958cbf6c2336f6a317"
+url = "https://github.com/moonrepo/moon/releases/download/v2.3.5/moon_cli-x86_64-unknown-linux-musl.tar.xz"
+
+[tools."aqua:moonrepo/moon"."platforms.macos-arm64"]
+checksum = "sha256:2b981e6827833771a51ac4766e9907d12e111bfa7272ab99b5dce28793401b8e"
+url = "https://github.com/moonrepo/moon/releases/download/v2.3.5/moon_cli-aarch64-apple-darwin.tar.xz"
+
+# Hand-added: `mise lock` resolves but does not persist moon's macos-x64 entry (a
+# mise write quirk); checksum from moon's published v2.3.5 .sha256 sidecar.
+# Re-running `mise lock` may drop this — re-add it if it disappears.
+[tools."aqua:moonrepo/moon"."platforms.macos-x64"]
+checksum = "sha256:ffc0bf6e808f2c08f97593adec269c41fc6396e1399f546f13bb2f878efb6ce7"
+url = "https://github.com/moonrepo/moon/releases/download/v2.3.5/moon_cli-x86_64-apple-darwin.tar.xz"
+
+[[tools."aqua:sigstore/cosign"]]
+version = "3.1.1"
+backend = "aqua:sigstore/cosign"
+
+[tools."aqua:sigstore/cosign"."platforms.linux-arm64"]
+checksum = "sha256:2ec865872e331c32fd12b08dae15332d3f92c0aa029219589684a4903ca85d11"
+url = "https://github.com/sigstore/cosign/releases/download/v3.1.1/cosign-linux-arm64"
+provenance = "cosign"
+
+[tools."aqua:sigstore/cosign"."platforms.linux-x64"]
+checksum = "sha256:ae1ecd212663f3693ad9edf8b1a183900c9a52d3155ba6e354237f9a0f6463fc"
+url = "https://github.com/sigstore/cosign/releases/download/v3.1.1/cosign-linux-amd64"
+provenance = "cosign"
+
+[tools."aqua:sigstore/cosign"."platforms.macos-arm64"]
+checksum = "sha256:94b42a9e697be95675f6160ab031a9a5f1ec1e646d6f648d7b2f5cd59ececbc5"
+url = "https://github.com/sigstore/cosign/releases/download/v3.1.1/cosign-darwin-arm64"
+provenance = "cosign"
+
+[tools."aqua:sigstore/cosign"."platforms.macos-x64"]
+checksum = "sha256:14d2678dfbfde18798151e86fbd91ebdadbb7424b18412a42a155dd8a2df4c7a"
+url = "https://github.com/sigstore/cosign/releases/download/v3.1.1/cosign-darwin-amd64"
+provenance = "cosign"
+
+[[tools."aqua:tilt-dev/ctlptl"]]
+version = "0.9.3"
+backend = "aqua:tilt-dev/ctlptl"
+
+[tools."aqua:tilt-dev/ctlptl"."platforms.linux-arm64"]
+checksum = "sha256:0361e76d6bdf55b58d8f8a6115d5fec5f74d0e375cac35fdef4cbd8b49c541a1"
+url = "https://github.com/tilt-dev/ctlptl/releases/download/v0.9.3/ctlptl.0.9.3.linux.arm64.tar.gz"
+
+[tools."aqua:tilt-dev/ctlptl"."platforms.linux-x64"]
+checksum = "sha256:c5130e27e367750f7d813558720921391233c98f35d6c3221793890b872769db"
+url = "https://github.com/tilt-dev/ctlptl/releases/download/v0.9.3/ctlptl.0.9.3.linux.x86_64.tar.gz"
+
+[tools."aqua:tilt-dev/ctlptl"."platforms.macos-arm64"]
+checksum = "sha256:ca047959bdad2cdc225879b26ae1b4be6c608053712587f1f5a53bb4cbd79f32"
+url = "https://github.com/tilt-dev/ctlptl/releases/download/v0.9.3/ctlptl.0.9.3.mac.arm64.tar.gz"
+
+[tools."aqua:tilt-dev/ctlptl"."platforms.macos-x64"]
+checksum = "sha256:68761b8768b4cddb849790ca320a3e99e2b470af86e1828392966944cdeaed74"
+url = "https://github.com/tilt-dev/ctlptl/releases/download/v0.9.3/ctlptl.0.9.3.mac.x86_64.tar.gz"
+
+[[tools."aqua:tilt-dev/tilt"]]
+version = "0.37.3"
+backend = "aqua:tilt-dev/tilt"
+
+[tools."aqua:tilt-dev/tilt"."platforms.linux-arm64"]
+checksum = "sha256:826f48198f368ef5edb684e9ae4c87ff76eca84c904f72b2376b29b93bffc019"
+url = "https://github.com/tilt-dev/tilt/releases/download/v0.37.3/tilt.0.37.3.linux.arm64.tar.gz"
+
+[tools."aqua:tilt-dev/tilt"."platforms.linux-x64"]
+checksum = "sha256:e90bc6cf70882bc7579d8174a27cab2de0284612ec7339e4b32f669cd5de4e5c"
+url = "https://github.com/tilt-dev/tilt/releases/download/v0.37.3/tilt.0.37.3.linux.x86_64.tar.gz"
+
+[tools."aqua:tilt-dev/tilt"."platforms.macos-arm64"]
+checksum = "sha256:4d1f4e604aa5ca65a2df0d19c9e9b351cf9703be886f52fa5f3afd317d968ffd"
+url = "https://github.com/tilt-dev/tilt/releases/download/v0.37.3/tilt.0.37.3.mac.arm64.tar.gz"
+
+[tools."aqua:tilt-dev/tilt"."platforms.macos-x64"]
+checksum = "sha256:c8e2b58fb7efdec9ae7e3fc4249b4f662dc6520eabe8efcac84b80856f20d31b"
+url = "https://github.com/tilt-dev/tilt/releases/download/v0.37.3/tilt.0.37.3.mac.x86_64.tar.gz"
+
+[[tools.go]]
+version = "1.26.3"
+backend = "core:go"
+
+[tools.go."platforms.linux-arm64"]
+checksum = "sha256:9d89a3ea57d141c2b22d70083f2c8459ba3890f2d9e818e7e933b75614936565"
+url = "https://dl.google.com/go/go1.26.3.linux-arm64.tar.gz"
+
+[tools.go."platforms.linux-x64"]
+checksum = "sha256:2b2cfc7148493da5e73981bffbf3353af381d5f93e789c82c79aff64962eb556"
+url = "https://dl.google.com/go/go1.26.3.linux-amd64.tar.gz"
+
+[tools.go."platforms.macos-arm64"]
+checksum = "sha256:875cf54a15311eee2c99b9dd67c68c4a49351d489ab622bf2cfd28c8f2078d3c"
+url = "https://dl.google.com/go/go1.26.3.darwin-arm64.tar.gz"
+
+[tools.go."platforms.macos-x64"]
+checksum = "sha256:278d580b32e299fe4a9c990fcf2d02acfe538c7e551a6ee18f9c7164573d2c63"
+url = "https://dl.google.com/go/go1.26.3.darwin-amd64.tar.gz"
+
+[[tools."go:sigs.k8s.io/controller-tools/cmd/controller-gen"]]
+version = "0.21.0"
+backend = "go:sigs.k8s.io/controller-tools/cmd/controller-gen"
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..bdaf0ba
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,65 @@
+# mise: tool + environment management for template-k8s.
+#
+# mise REPLACES Proto (the former .prototools + .moon/proto/*) and the .envrc
+# direnv shim activation. The committed mise.lock records per-platform download
+# URLs + checksums; for aqua-backed tools it additionally carries cosign / SLSA /
+# GitHub-attestation verification. `settings.locked` makes `mise install` FAIL
+# CLOSED when a tool lacks a pre-resolved URL for the current platform.
+#
+# moon stays the task runner / CI gate; it is configured (.moon/toolchains.yml +
+# moon.yml `toolchains.default: system`) to run these tools as `system` binaries
+# that mise puts on PATH.
+#
+# Bump a tool: edit its version here, then
+#   mise lock --platform linux-x64,linux-arm64,macos-x64,macos-arm64
+# and commit mise.toml + mise.lock together.
+
+[tools]
+# Language runtime (core backend). Authoritative, and matches go.mod's `go 1.26.3`.
+go = "1.26.3"
+
+# Task runner / CI gate. moon itself is now mise-managed (CI installs it via mise
+# instead of moonrepo/setup-toolchain).
+"aqua:moonrepo/moon" = "2.3.5"
+
+# Go dev-tool CLIs. Explicit `aqua:` refs force the VERIFYING backend (checksum +
+# cosign/SLSA/GitHub-attestation recorded in mise.lock); they must never fall back
+# to a version-only backend (asdf), which records no checksum.
+"aqua:golangci/golangci-lint" = "2.11.4"
+
+# Kubebuilder operator toolchain.
+"aqua:kubernetes-sigs/kubebuilder"                     = "4.14.0"
+"aqua:kubernetes-sigs/controller-runtime/setup-envtest" = "0.24.1"
+"aqua:kubernetes/kubernetes/kubectl"                   = "1.35.5"
+"aqua:helm/helm"                                       = "4.0.4"
+"aqua:kyverno/chainsaw"                                = "0.2.15"
+
+# controller-gen ships no aqua package; the Go backend is its canonical install
+# (`go install sigs.k8s.io/controller-tools/cmd/controller-gen`) and yields a
+# correctly named `controller-gen` binary. Integrity is the Go checksum database.
+"go:sigs.k8s.io/controller-tools/cmd/controller-gen" = "0.21.0"
+
+# Local dev stack (ko + Tilt + ctlptl + kind) behind `moon run dev-up`.
+"aqua:ko-build/ko"      = "0.18.1"
+"aqua:tilt-dev/tilt"    = "0.37.3"
+"aqua:tilt-dev/ctlptl"  = "0.9.3"
+"aqua:kubernetes-sigs/kind" = "0.31.0"
+
+# Supply-chain / container build CLIs. melange + apko build and sign the release
+# operator image; cosign is used for keyless image signing in the release
+# workflow. Pinned here now so the toolset is locked in one place.
+"aqua:chainguard-dev/melange" = "0.54.0"
+"aqua:chainguard-dev/apko"    = "1.2.19"
+"aqua:sigstore/cosign"        = "3.1.1"
+
+[env]
+# Pin the Go toolchain: never auto-download a toolchain other than the one above.
+# The version here is authoritative and matches go.mod's `go 1.26.3`.
+GOTOOLCHAIN = "local"
+
+[settings]
+# Read/write mise.lock, and fail closed if a tool lacks a pre-resolved URL for the
+# current platform — replaces Proto's `checksum-url` pins and extends integrity
+# enforcement to every aqua-backed tool.
+lockfile = true
+locked = true
diff --git a/moon.yml b/moon.yml
index fa616c8..aa311e1 100644
--- a/moon.yml
+++ b/moon.yml
@@ -9,6 +9,11 @@ project:
   maintainers:
     - 'meigma'
 
+# Every task runs against `system` binaries that mise (mise.toml + mise.lock) puts
+# on PATH; moon manages no language toolchain itself.
+toolchains:
+  default: 'system'
+
 fileGroups:
   goSources:
     - 'api/**/*.go'
@@ -34,9 +39,12 @@ fileGroups:
     - 'Tiltfile'
     - 'dev/ctlptl.yaml'
     - 'dev/ko-build.sh'
+  # Tool/version pins. Under the `system` toolchain moon does not hash a tool
+  # binary's version, so the mise pins are task inputs — bumping any tool in mise
+  # must invalidate the tasks that consume it.
   toolchainConfig:
-    - '.prototools'
-    - '.moon/proto/**/*.toml'
+    - 'mise.toml'
+    - 'mise.lock'
 
 workspace:
   inheritedTasks: