diff --git a/.claude/hooks/stop-lint-gate.sh b/.claude/hooks/stop-lint-gate.sh
index 43399c9..d68464f 100755
--- a/.claude/hooks/stop-lint-gate.sh
+++ b/.claude/hooks/stop-lint-gate.sh
@@ -4,6 +4,11 @@
 
 cd "$CLAUDE_PROJECT_DIR" || exit 0
 
+# Ensure node/yarn are on PATH via mise
+eval "$(mise activate bash --shims)" 2> /dev/null
+node_dir="$(mise where node 2> /dev/null)/bin"
+[ -d "$node_dir" ] && export PATH="$node_dir:$PATH"
+
 output=$(yarn lint 2>&1)
 status=$?
 
diff --git a/.mise.toml b/.mise.toml
index 9a5f95c..3aaa63e 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -1,4 +1,4 @@
 [tools]
 node = "24.14.0"
-python = "3.14.3"
+python = "3.13.12"
 go = "1.26.1"
diff --git a/config/fish/config.fish b/config/fish/config.fish
index b551cf7..932d87f 100644
--- a/config/fish/config.fish
+++ b/config/fish/config.fish
@@ -52,4 +52,4 @@ source ~/.orbstack/shell/init2.fish 2>/dev/null || :
 if status is-interactive; and not set -q GITHUB_TOKEN
     echo "Warning: GITHUB_TOKEN is not set" >&2
 end
-eval "$(/opt/homebrew/bin/brew shellenv fish)"
+test -x /opt/homebrew/bin/brew; and eval "$(/opt/homebrew/bin/brew shellenv fish)"
diff --git a/config/mise/config.toml b/config/mise/config.toml
index c615beb..51dd63d 100644
--- a/config/mise/config.toml
+++ b/config/mise/config.toml
@@ -1,8 +1,34 @@
+[settings]
+# Use uvx (from uv) instead of requiring pipx to be installed separately
+pipx.uvx = true
+# Compile Python from source — precompiled freethreaded builds lack a lib/ dir
+python.compile = true
+trusted_config_paths = [
+  "~/Code/ivuorinen",
+  "~/Code/s",
+  "~/Code/masf",
+]
+# Respect .nvmrc, .python-version, .ruby-version, etc. in other projects.
+# This repo uses .mise.toml at the repo root for pinned versions.
+idiomatic_version_file = true
+idiomatic_version_file_enable_tools = [
+  "node", "python", "ruby", "go", "java",
+  "terraform", "yarn", "bun", "deno", "dotnet",
+]
+
+# Generate mise.lock for reproducible installs
+lockfile = true
+
+# Save disk space — don't keep downloaded archives or failed installs
+always_keep_download = false
+always_keep_install = false
+experimental = true
+
 [tools]
 # Language runtimes
 node = "lts"
-python = "3"
-go = "latest"
+python = "3.13"
+go = "1.26.1"
 rust = "stable"
 
 # Pre-built binaries via aqua registry
@@ -12,7 +38,7 @@ eza = "latest"
 bottom = "latest"
 zoxide = "latest"
 tree-sitter = "latest"
-neovim = "latest" # Neovim editor binary
+neovim = "0.11.6" # Neovim editor binary
 delta = "latest"
 difftastic = "latest"
 
@@ -38,25 +64,27 @@ editorconfig-checker = "latest"
 "npm:corepack" = "latest"
 
 # Python tools (via pipx backend)
-"pipx:detect-secrets" = "latest"
-"pipx:git-filter-repo" = "latest"
+# Disabled: mise pipx backend can't find uvx when uv is mise-managed
+# See https://github.com/jdx/mise/discussions/7477
+# "pipx:detect-secrets" = "latest"
+# "pipx:git-filter-repo" = "latest"
 yamllint = "latest"
-ansible = "latest"
-"pipx:ansible-lint" = "latest"
+# ansible = "13.4.0"
+# "pipx:ansible-lint" = "latest"
 ruff = "latest"
-"pipx:openapi-python-client" = "latest"
-"pipx:python-lsp-server[websockets]" = "latest"
+# "pipx:openapi-python-client" = "latest"
+# "pipx:python-lsp-server[websockets]" = "latest"
 
 # .NET tools (via dotnet backend)
 "dotnet:coverlet.console" = "latest"
 "dotnet:csharpier" = "latest"
 "dotnet:ilspycmd" = "latest"
-"dotnet:dotnet-ef" = "latest"
+"dotnet:dotnet-ef" = "10.0.5"
 
 # DevOps & security tools
 act = "latest"
 age = "latest"
-aws-cli = "latest"
+aws-cli = "2.34.14"
 checkov = "latest"
 grype = "latest"
 pinact = "latest"
@@ -71,12 +99,10 @@ lazygit = "latest"
 bat = "latest"
 bats = "latest"
 choose = "latest"
-cmake = "latest"
-gdu = "latest"
+cmake = "4.3.0"
 github-cli = "latest"
 jq = "latest"
 hadolint = "latest"
-hugo = "latest"
 just = "latest"
 yq = "latest"
 "github:exercism/cli" = "latest"
@@ -92,31 +118,9 @@ oh-my-posh = "latest"
 "github:wakatime/wakatime-cli" = "latest"
 
 # Terraform (replaces tfenv)
-terraform = "latest"
+terraform = "1.14.7"
 tflint = "latest"
 tfsec = "latest"
 
 # Other useful tools
 uv = "latest"
-
-[settings]
-trusted_config_paths = [
-  "~/Code/ivuorinen",
-  "~/Code/s",
-  "~/Code/masf",
-]
-# Respect .nvmrc, .python-version, .ruby-version, etc. in other projects.
-# This repo uses .mise.toml at the repo root for pinned versions.
-idiomatic_version_file = true
-idiomatic_version_file_enable_tools = [
-  "node", "python", "ruby", "go", "java",
-  "terraform", "yarn", "bun", "deno", "dotnet",
-]
-
-# Generate mise.lock for reproducible installs
-lockfile = true
-
-# Save disk space — don't keep downloaded archives or failed installs
-always_keep_download = false
-always_keep_install = false
-experimental = true
diff --git a/install.conf.yaml b/install.conf.yaml
index 8f5b8c3..73dffc3 100644
--- a/install.conf.yaml
+++ b/install.conf.yaml
@@ -5,8 +5,10 @@
     ~/:
     ~/.config:
       recursive: true
-    ~/.local:
+    ~/.local/bin:
+    ~/.local/man:
       recursive: true
+    ~/.local/share:
     ~/.ssh:
       recursive: true
 
@@ -35,12 +37,16 @@
       glob: true
       path: base/*
       prefix: "."
+    # mise config — force-relink because mise may create the file before Dotbot runs
+    ~/.config/mise/config.toml:
+      force: true
+      path: config/mise/config.toml
     # Most of the configs
     ~/.config/:
       glob: true
       relink: true
       path: config/*
-      exclude: [config/fzf, config/op]
+      exclude: [config/op, config/mise]
     # 1Password CLI plugins
     ~/.config/op/plugins.sh:
       relink: true
@@ -52,10 +58,6 @@
     ~/.local/bin:
       glob: true
       path: local/bin/*
-      exclude: [local/bin/fzf]
-    ~/.local/fzf:
-      glob: true
-      path: config/fzf/*
     # Manuals
     ~/.local/man:
       glob: true
diff --git a/local/bin/fzf b/local/bin/fzf
deleted file mode 100755
index 8558309..0000000
Binary files a/local/bin/fzf and /dev/null differ
diff --git a/scripts/install-dnf-packages.sh b/scripts/install-dnf-packages.sh
index f59f6c4..8d691cb 100755
--- a/scripts/install-dnf-packages.sh
+++ b/scripts/install-dnf-packages.sh
@@ -42,11 +42,11 @@ packages=(
 # Install the Development Tools dnf group
 install_dev_tools_group()
 {
-  if dnf group list installed 2> /dev/null | grep -q "Development Tools"; then
+  if dnf group list installed 2> /dev/null | grep -q "development-tools"; then
     msgr ok "@development-tools group already installed"
   else
     msgr run "Installing @development-tools group"
-    sudo dnf group install -y "Development Tools"
+    sudo dnf group install -y "development-tools"
   fi
   return 0
 }