diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5b89653ca..bc4fbf291 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -941,7 +941,7 @@ jobs:
     name: Sign, package, and smoke Windows Desktop
     if: needs.validate.outputs.publish_draft == 'true'
     needs: validate
-    runs-on: windows-2025
+    runs-on: windows-latest-l
     environment: release-signing
     timeout-minutes: 100
     permissions:
diff --git a/flake.nix b/flake.nix
index 08c34dc49..792b6c451 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,23 +12,23 @@
         "x86_64-linux"
       ];
       forAllSystems = nixpkgs.lib.genAttrs systems;
-      version = "0.10.9";
+      version = "0.11.0";
       releases = {
         aarch64-darwin = {
           target = "aarch64-apple-darwin";
-          sha256 = "9eb7f10e7cd345c20b3c63b51484d3749bd76ae2bd470fa6756781783f6742d9";
+          sha256 = "c5140fa28173641838069e4ec331ef3848c8f3a4f3149b174e09380719e75b9a";
         };
         x86_64-darwin = {
           target = "x86_64-apple-darwin";
-          sha256 = "5b9a57ccd2fdc5efe8c41b5e24594daacf9dfafa38bce3a3f240f7a07dd272fa";
+          sha256 = "c274017f83a11b47123e80471417548029123b245ae04b0ae4386b78c2b07478";
         };
         aarch64-linux = {
           target = "aarch64-unknown-linux-musl";
-          sha256 = "a1b7d0c3501615b016d27a24d069a17b383dbb923654f65c0c83b3cbd5fd7fe9";
+          sha256 = "efad03b81b04b66900acd4c835031aca4c2be4294a409d0c23df643e0f277407";
         };
         x86_64-linux = {
           target = "x86_64-unknown-linux-musl";
-          sha256 = "19d7e1e19f2bbfecfef486294f89f9802aec9a0447857119ffa855513e93250d";
+          sha256 = "f520245f4c02e5c3fe7b3e926bb2663d39b97566f0eefa34ef860a09d515f9c5";
         };
       };
     in {
diff --git a/packaging/homebrew/Formula/colossus.rb b/packaging/homebrew/Formula/colossus.rb
index 093a6ab1c..93815ba44 100644
--- a/packaging/homebrew/Formula/colossus.rb
+++ b/packaging/homebrew/Formula/colossus.rb
@@ -5,11 +5,11 @@ class Colossus < Formula
 
   on_macos do
     if Hardware::CPU.arm?
-      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.9/colossus-0.10.9-aarch64-apple-darwin.tar.gz"
-      sha256 "9eb7f10e7cd345c20b3c63b51484d3749bd76ae2bd470fa6756781783f6742d9"
+      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.11.0/colossus-0.11.0-aarch64-apple-darwin.tar.gz"
+      sha256 "c5140fa28173641838069e4ec331ef3848c8f3a4f3149b174e09380719e75b9a"
     else
-      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.9/colossus-0.10.9-x86_64-apple-darwin.tar.gz"
-      sha256 "5b9a57ccd2fdc5efe8c41b5e24594daacf9dfafa38bce3a3f240f7a07dd272fa"
+      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.11.0/colossus-0.11.0-x86_64-apple-darwin.tar.gz"
+      sha256 "c274017f83a11b47123e80471417548029123b245ae04b0ae4386b78c2b07478"
     end
   end
 
@@ -19,7 +19,9 @@ def install
       libexec.install "tools/rg" => "rg"
       (share/"licenses/colossus/ripgrep").install "tools/COPYING", "tools/LICENSE-MIT", "tools/UNLICENSE"
     end
-    (bin/"colossus").write_env_script libexec/"colossus", COLOSSUS_INSTALLER_KIND: "homebrew", COLOSSUS_BUNDLED_RIPGREP: ((libexec/"rg").exist? ? "1" : "0")
+    bundled_rg = (libexec/"rg").exist? ? "1" : "0"
+    env = { COLOSSUS_INSTALLER_KIND: "homebrew", COLOSSUS_BUNDLED_RIPGREP: bundled_rg }
+    (bin/"colossus").write_env_script libexec/"colossus", env
   end
 
   test do
diff --git a/scripts/ci/desktop-contract.test.mjs b/scripts/ci/desktop-contract.test.mjs
index 9a88fa640..fbb512bba 100644
--- a/scripts/ci/desktop-contract.test.mjs
+++ b/scripts/ci/desktop-contract.test.mjs
@@ -1205,6 +1205,7 @@ test("Developer Preview compilation and ad-hoc signing use separate runners", ()
   assert.match(windowsJob, /Start-Process -FilePath \$uninstallers/u);
   assert.match(windowsJob, /Colossus processes remained after uninstall/u);
 
+  assert.match(signedWindowsJob, /runs-on: windows-latest-l/u);
   assert.match(signedWindowsJob, /environment: release-signing/u);
   assert.match(signedWindowsJob, /id-token: write/u);
   assert.match(signedWindowsJob, /COLOSSUS_DESKTOP_TEAM_ID: OBSCURITY_LABS_LLC/u);
diff --git a/scripts/ci/homebrew-formula.test.mjs b/scripts/ci/homebrew-formula.test.mjs
index 6a4eb9357..157e581d0 100644
--- a/scripts/ci/homebrew-formula.test.mjs
+++ b/scripts/ci/homebrew-formula.test.mjs
@@ -39,9 +39,10 @@ test("renders a fixed-origin two-architecture prebuilt formula", () => {
   assert.match(formula, /b{64}/u);
   assert.match(
     formula,
-    /\(bin\/"colossus"\)\.write_env_script libexec\/"colossus", COLOSSUS_INSTALLER_KIND: "homebrew"/u,
+    /\(bin\/"colossus"\)\.write_env_script libexec\/"colossus", env/u,
   );
   assert.match(formula, /COLOSSUS_INSTALLER_KIND: "homebrew"/u);
+  assert.match(formula, /COLOSSUS_BUNDLED_RIPGREP: bundled_rg/u);
   assert.match(formula, /colossus --version/u);
   assert.doesNotMatch(formula, /^\s*version\s+"/mu);
   assert.doesNotMatch(formula, /\n\s*bin\.write_env_script/u);
diff --git a/scripts/ci/render-homebrew-formula.mjs b/scripts/ci/render-homebrew-formula.mjs
index 376253811..680a454a7 100644
--- a/scripts/ci/render-homebrew-formula.mjs
+++ b/scripts/ci/render-homebrew-formula.mjs
@@ -55,7 +55,9 @@ function render(version, armSha, intelSha) {
       libexec.install "tools/rg" => "rg"
       (share/"licenses/colossus/ripgrep").install "tools/COPYING", "tools/LICENSE-MIT", "tools/UNLICENSE"
     end
-    (bin/"colossus").write_env_script libexec/"colossus", COLOSSUS_INSTALLER_KIND: "homebrew", COLOSSUS_BUNDLED_RIPGREP: ((libexec/"rg").exist? ? "1" : "0")
+    bundled_rg = (libexec/"rg").exist? ? "1" : "0"
+    env = { COLOSSUS_INSTALLER_KIND: "homebrew", COLOSSUS_BUNDLED_RIPGREP: bundled_rg }
+    (bin/"colossus").write_env_script libexec/"colossus", env
   end
 
   test do