diff --git a/.github/renovate.json b/.github/renovate.json
index 2fd35dc0..235712d6 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -23,16 +23,13 @@
     "The commit vocabulary these rules emit is enumerated in commitlint.config.js and explained in .claude/rules/commits.md; the preset pin and that enum have to move together, because two of the scopes are emitted upstream."
   ],
   "extends": [
-    ":ignoreModulesAndTests",
     "abandonments:recommended",
     "docker:pinDigests",
     "helpers:pinGitHubActionDigests",
-    "mergeConfidence:age-confidence-badges",
-    "mergeConfidence:all-badges",
     "github>ppat/coder//.github/renovate/scope-fallback",
-    "github>ppat/renovate-presets#v1.0.0",
-    "github>ppat/renovate-presets:dev-tools#v1.0.0",
-    "github>ppat/renovate-presets:github-actions#v1.0.0",
+    "github>ppat/renovate-presets#v1.0.1",
+    "github>ppat/renovate-presets:dev-tools#v1.0.1",
+    "github>ppat/renovate-presets:github-actions#v1.0.1",
     "github>ppat/coder//.github/renovate/scope-internal",
     "github>ppat/coder//.github/renovate/scope-shipped",
     "github>ppat/coder//.github/renovate/exceptions"
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index cd74f514..7ed9698c 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -97,7 +97,7 @@ jobs:
     timeout-minutes: 5
     steps:
     - name: Setup repository and tools
-      uses: ppat/homelab-ops-actions/actions/setup-repository-tools@0909115ff750ef6935faf8ca8b64b0dc4bbbc38f # v2.9.0
+      uses: ppat/homelab-ops-actions/actions/setup-repository-tools@c2a67c08adba12689a0d09d311b3339a1853b8c5 # v2.11.0
       with:
         current_fetch_depth: 1
         current_git_ref: ${{ github.head_ref }}
diff --git a/.github/workflows/release-sweep.yaml b/.github/workflows/release-sweep.yaml
index b9782fd1..754455c1 100644
--- a/.github/workflows/release-sweep.yaml
+++ b/.github/workflows/release-sweep.yaml
@@ -44,7 +44,7 @@ jobs:
         fetch-depth: 0
         persist-credentials: false
     - name: Sweep release pull requests
-      uses: ppat/homelab-ops-actions/actions/release-sweep@0909115ff750ef6935faf8ca8b64b0dc4bbbc38f # v2.9.0
+      uses: ppat/homelab-ops-actions/actions/release-sweep@c2a67c08adba12689a0d09d311b3339a1853b8c5 # v2.11.0
       with:
         # Pull requests touching this file run only the built-in read token; the monthly
         # schedule supplies the App token needed for an authorized, live merge.
diff --git a/.github/workflows/test-template.yaml b/.github/workflows/test-template.yaml
index 4586660b..3b7dc9a8 100644
--- a/.github/workflows/test-template.yaml
+++ b/.github/workflows/test-template.yaml
@@ -35,7 +35,7 @@ jobs:
       # reference below) and, with no mise_toml override, installs straight from
       # current/mise.toml - the same `opentofu` pin the authoring toolchain uses
       # locally, so there's no second version string to drift from it.
-      uses: ppat/homelab-ops-actions/actions/setup-repository-tools@0909115ff750ef6935faf8ca8b64b0dc4bbbc38f # v2.9.0
+      uses: ppat/homelab-ops-actions/actions/setup-repository-tools@c2a67c08adba12689a0d09d311b3339a1853b8c5 # v2.11.0
       with:
         current_git_ref: ${{ github.head_ref || github.ref }}
         current_repository: ${{ github.repository }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 80cca0c1..3c86ffef 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,4 +1,7 @@
 ---
+default_language_version:
+  node: 26.13.0
+  python: 3.15.2
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v6.0.0
@@ -36,6 +39,7 @@ repos:
   rev: v9.27.0
   hooks:
   - id: commitlint
+    language: node
     stages: [commit-msg]
     additional_dependencies:
     - '@commitlint/cli@19.6.1'
diff --git a/mise.toml b/mise.toml
index 87c819d8..64044bb1 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,8 +1,8 @@
 [tools]
-bun = "1.4.3"
-node = "24.21.0"
+bun = "1.4.4"
+node = "26.13.0"
 opentofu = "1.13.2"
 tflint = "0.64.0"
 
 [settings.npm]
-bun = true
+package_manager = "bun"