diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42ef1d89..4e1b6969 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ env:
   CHEZMOI_CACHE_DIR: /tmp/.chezmoi-cache
   CHEZMOI_CONFIG: /tmp/.chezmoi-config.toml
   CHEZMOI_DEST: /tmp/chezmoi-test
-  CHEZMOI_VERSION: v2.70.5
+  CHEZMOI_VERSION: v2.71.0
 
 defaults:
   run:
diff --git a/src/chezmoi/.chezmoidata/bin/mise.toml b/src/chezmoi/.chezmoidata/bin/mise.toml
index bb63cd0f..4a0c6d44 100644
--- a/src/chezmoi/.chezmoidata/bin/mise.toml
+++ b/src/chezmoi/.chezmoidata/bin/mise.toml
@@ -1,6 +1,6 @@
 # mise version already includes "v" prefix — tag_format = "{version}" (no added v)
 [bin.mise]
-version = "v2026.7.0"
+version = "v2026.7.7"
 
 [bin.mise.github_releases]
 repo            = "jdx/mise"
@@ -18,10 +18,10 @@ linux_amd64  = "linux-x64"
 linux_arm64  = "linux-arm64"
 
 [bin.mise.github_releases.checksums]
-darwin_arm64 = "cc5a708f75e9a84e007a650c23b127e79e54aacf0e41378d75bb15795e9ed54d"
-darwin_amd64 = "c0debad068ea3e1e525d6580168e0be4759295cdd9049b6ab1aac37d90e952de"
-linux_amd64  = "0744cb3c303baf0d308ff7b112ed41f22abb6029cb5644fd3a8ce74b29f16a68"
-linux_arm64  = "50d3752baf2d6542bf7b8cff1146e0fd9517531c74171b93a1e4b63dcd2d64e8"
+darwin_arm64 = "5b890cccc75fc43a494b83ace21dbd2ee26120ff19ba1994cdcd054b3a15abbd"
+darwin_amd64 = "7b860e6495eea9a264a16dae575ac20d5618ea2fe97905756c661eb02035c5d9"
+linux_amd64  = "429f71e7e989908bf975aafac9066329c16e2d8fc7cd8e74fdf21dd6300ffe7c"
+linux_arm64  = "1b4ef061d25f0ceb508f11169482f3074e55c1698a1494f666386b2fcfb46b9b"
 
 [mise]
 
diff --git a/src/chezmoi/.chezmoiscripts/run_onchange_after_06_trust-install-global-mise-tools.sh.tmpl b/src/chezmoi/.chezmoiscripts/run_onchange_after_06_trust-install-global-mise-tools.sh.tmpl
index 547278de..8ed78355 100644
--- a/src/chezmoi/.chezmoiscripts/run_onchange_after_06_trust-install-global-mise-tools.sh.tmpl
+++ b/src/chezmoi/.chezmoiscripts/run_onchange_after_06_trust-install-global-mise-tools.sh.tmpl
@@ -30,6 +30,19 @@ else
     exit 1
 fi
 
+# Global config resolution cascades into any `mise install -C <dir>` call
+# elsewhere (e.g. the repo-tools script), so a locked install run from the
+# repo re-validates these global tools too. Without a global lockfile they
+# have nothing to validate against and fail as "not in the lockfile" --
+# writing one here (never committed; see AGENTS.md) closes that gap.
+log_info "Locking global mise tools in {{ .chezmoi.destDir }}..."
+if MISE_LOCKED=0 "$MISE" -C "{{ .chezmoi.destDir }}" lock --global; then
+    log_success "Global mise tools locked in {{ .chezmoi.destDir }}."
+else
+    log_error "Failed to lock global mise tools in {{ .chezmoi.destDir }}."
+    exit 1
+fi
+
 log_info "Pruning unused global mise tools in {{ .chezmoi.destDir }}..."
 if "$MISE" prune -y -C "{{ .chezmoi.destDir }}"; then
     log_success "Global mise tools pruned in {{ .chezmoi.destDir }}."