diff --git a/.github/workflows/run-script.yml b/.github/workflows/run-script.yml
index 9a13e6f..a07a6ed 100644
--- a/.github/workflows/run-script.yml
+++ b/.github/workflows/run-script.yml
@@ -18,6 +18,10 @@ on:
         type: boolean
         description: "Expose the job's read-only GitHub token to the script as GH_TOKEN"
         default: false
+      mise-env:
+        type: string
+        description: "Value for MISE_ENV, selecting additional mise.<env>.toml config files"
+        default: ""
     secrets:
       STEP_SECURITY_API_KEY:
         required: false
@@ -29,6 +33,8 @@ jobs:
       contents: read
     env:
       HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} # zizmor: ignore[secrets-outside-env]
+      MISE_ENV: ${{ inputs.mise-env }}
+      MISE_LOCKED: "1"
     steps:
       - name: Harden Runner
         if: env.HARDEN_RUNNER == 'true'
diff --git a/.tool-versions b/.tool-versions
deleted file mode 100644
index 9373257..0000000
--- a/.tool-versions
+++ /dev/null
@@ -1,3 +0,0 @@
-just 1.58.0
-prek 0.5.5
-uv 0.12.23
diff --git a/README.md b/README.md
index fc38592..75fe760 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,15 @@ commits never get one, so a SHA is what names the commit you meant.
 
 Run a set of commands on the repository, with the required tools installed via `mise`.
 
+Tools are read from `mise.toml`, and the `mise.lock` lockfile is required to be
+present and contain all the tools to install. `.tool-versions` is not supported
+due to lack of hash pinning.
+
+Set `mise-env` to select a [mise
+environment](https://mise.jdx.dev/configuration/environments.html) via
+`MISE_ENV`, so that `mise.<env>.toml` files (such as one with CI-only tools)
+are loaded on top of the default config.
+
 
 ```
   Lint:
diff --git a/mise.lock b/mise.lock
new file mode 100644
index 0000000..d29f948
--- /dev/null
+++ b/mise.lock
@@ -0,0 +1,69 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools.just]]
+version = "1.58.0"
+backend = "aqua:casey/just"
+
+[tools.just."platforms.linux-arm64"]
+checksum = "sha256:748237128c4c40cbdabc65e841d05ceba13cc23a91eaba395495894c1d9764df"
+url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-aarch64-unknown-linux-musl.tar.gz"
+
+[tools.just."platforms.linux-x64"]
+checksum = "sha256:4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d"
+url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-x86_64-unknown-linux-musl.tar.gz"
+
+[tools.just."platforms.macos-arm64"]
+checksum = "sha256:50ae3e996c974a0bf32ea7d10f495070df33f1b43e0616b2769e3d4821ed8f48"
+url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-aarch64-apple-darwin.tar.gz"
+
+[tools.just."platforms.macos-x64"]
+checksum = "sha256:9a09cfef66aaa79da58203970103a0684307716caaabd3e9844cacc4dc0f4023"
+url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-x86_64-apple-darwin.tar.gz"
+
+[[tools.prek]]
+version = "0.5.5"
+backend = "aqua:j178/prek"
+
+[tools.prek."platforms.linux-arm64"]
+checksum = "sha256:e7208e5d42daaa8d9167971e7d2d3388d80cce241d1cecea745a6c88d6b6368e"
+url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-aarch64-unknown-linux-musl.tar.gz"
+provenance = "github-attestations"
+
+[tools.prek."platforms.linux-x64"]
+checksum = "sha256:57948d4772f4eb58387ce4a6d619ecd2d8d7e9d765eed6a316f5b3f92c86d951"
+url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-x86_64-unknown-linux-musl.tar.gz"
+provenance = "github-attestations"
+
+[tools.prek."platforms.macos-arm64"]
+checksum = "sha256:e4bc3132023b50020e62b073bc3147082828bf250d8b9282850c6f2bed5471b6"
+url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-aarch64-apple-darwin.tar.gz"
+provenance = "github-attestations"
+
+[tools.prek."platforms.macos-x64"]
+checksum = "sha256:9ea09639374a34b6f0b7d2a2567c175221cd37e44004e9b1cf591f31f9dda1b3"
+url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-x86_64-apple-darwin.tar.gz"
+provenance = "github-attestations"
+
+[[tools.uv]]
+version = "0.13.4"
+backend = "aqua:astral-sh/uv"
+
+[tools.uv."platforms.linux-arm64"]
+checksum = "sha256:253a17cadcb659ae77a0fe3b9a2f1c14297528d480c421899e61e64d64f24e8f"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-musl.tar.gz"
+provenance = "github-attestations"
+
+[tools.uv."platforms.linux-x64"]
+checksum = "sha256:28d4385f9f9d1d1c7654d85b3855e0e2615b2f6cc13136a2edff858bbdc16ff1"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-musl.tar.gz"
+provenance = "github-attestations"
+
+[tools.uv."platforms.macos-arm64"]
+checksum = "sha256:e0b1d4743ce64c55d9f0f4a444afa6b81125680070ee04e853fcd0f6c1ebf8f1"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz"
+provenance = "github-attestations"
+
+[tools.uv."platforms.macos-x64"]
+checksum = "sha256:7be2dcd316122f4b3e5a0a7889f6248266c14425374e105ff7dc9779184603a6"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz"
+provenance = "github-attestations"
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..5fe9d32
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,8 @@
+[tools]
+just = "1.58.0"
+prek = "0.5.5"
+uv = "0.13.4"
+
+[settings]
+lockfile = true
+lockfile_platforms = ["linux-x64", "linux-arm64", "macos-x64", "macos-arm64"]