diff --git a/.github/workflows/docs-website.yaml b/.github/workflows/docs-website.yaml
index 5ddf9c9..781002e 100644
--- a/.github/workflows/docs-website.yaml
+++ b/.github/workflows/docs-website.yaml
@@ -34,7 +34,7 @@ env:
   MISE_TASK_RUN_AUTO_INSTALL: "false"
   # mise itself, pinned; go.yaml explains why.
   # renovate: datasource=github-releases depName=jdx/mise extractVersion=^v(?<version>.+)$
-  MISE_VERSION: 2026.10.23
+  MISE_VERSION: 2026.10.24
 
 permissions:
   contents: read
diff --git a/.github/workflows/go.yaml b/.github/workflows/go.yaml
index 4620c38..6c95fa9 100644
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@@ -23,7 +23,7 @@ env:
   # binary in the restored cache, warns that it failed integrity verification
   # and downloads it again.
   # renovate: datasource=github-releases depName=jdx/mise extractVersion=^v(?<version>.+)$
-  MISE_VERSION: 2026.10.23
+  MISE_VERSION: 2026.10.24
   # Every tool a CI job runs, installed in every job. mise-action keys its
   # cache on install_args, so one list means one cache: main's runs save it
   # and every pull request restores it, rather than each job, and each pull
diff --git a/.github/workflows/pr-hygiene.yaml b/.github/workflows/pr-hygiene.yaml
index f4b9b85..74fc2d4 100644
--- a/.github/workflows/pr-hygiene.yaml
+++ b/.github/workflows/pr-hygiene.yaml
@@ -11,7 +11,7 @@ on:
 env:
   # mise itself, pinned; go.yaml explains why.
   # renovate: datasource=github-releases depName=jdx/mise extractVersion=^v(?<version>.+)$
-  MISE_VERSION: 2026.10.23
+  MISE_VERSION: 2026.10.24
 
 jobs:
   pr-title:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ddcfc39..eb2e470 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -21,7 +21,7 @@ permissions:
 env:
   # mise itself, pinned; go.yaml explains why.
   # renovate: datasource=github-releases depName=jdx/mise extractVersion=^v(?<version>.+)$
-  MISE_VERSION: 2026.10.23
+  MISE_VERSION: 2026.10.24
 
 # Never cancel a release half-way: that can leave a tag published with no
 # artifacts. Pushes key on the SHA so each commit gets its own run; repairs key