diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 8e111fb11..adefc6242 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -32,6 +32,6 @@ runs:
       run: |
         echo "UV_FROZEN=true" >> $GITHUB_ENV
     
-    - uses: jdx/mise-action@5083fe46898c414b2475087cc79da59e7da859e8
+    - uses: jdx/mise-action@5ff8b6c87089a23d44f61309fd05300c2f616b73
       with:
-        version: 2025.2.6
+        version: 2026.1.0
diff --git a/apps/agentstack-sdk-py/tasks.toml b/apps/agentstack-sdk-py/tasks.toml
index fc9903cb1..9a7ee2436 100644
--- a/apps/agentstack-sdk-py/tasks.toml
+++ b/apps/agentstack-sdk-py/tasks.toml
@@ -76,9 +76,10 @@ outputs = { auto = true }
 # test
 
 ["agentstack-sdk-py:test-all"]
+usage = 'flag "--python <python>" default="3.13"'
 run = """
 #!/bin/bash
-uv run --python={{option(name="python", default="3.13")}} pytest
+uv run --python="${usage_python?}" pytest
 """
 
 depends = ["agentstack-sdk-py:setup"]
diff --git a/apps/agentstack-server/tasks.toml b/apps/agentstack-server/tasks.toml
index cef3d819a..036379e06 100644
--- a/apps/agentstack-server/tasks.toml
+++ b/apps/agentstack-server/tasks.toml
@@ -113,6 +113,7 @@ run = "uv run migrate"
 
 ["agentstack-server:migrations:alembic:nocheck"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'arg "[alembic_vars]" var=#true'
 run = """
 #!/bin/bash
 set -a
@@ -120,11 +121,12 @@ source .env
 set +a
 
 cd src/agentstack_server/infrastructure/persistence/migrations
-uv run alembic {{arg(name="alembic_vars", var=true)}}
+uv run alembic ${usage_alembic_vars}
 """
 
 ["agentstack-server:migrations:alembic"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'arg "[alembic_vars]" var=#true'
 run = """
 #!/bin/bash
 set -a
@@ -137,7 +139,7 @@ if ! telepresence list --replacements 2>/dev/null | grep -q agentstack; then
 fi
 
 cd src/agentstack_server/infrastructure/persistence/migrations
-uv run alembic {{arg(name="alembic_vars", var=true)}}
+uv run alembic ${usage_alembic_vars}
 """
 
 ["agentstack-server:migrations:generate"]
@@ -152,10 +154,14 @@ run = "{{ mise_bin }} run agentstack:shell --vm-name=agentstack-local-dev"
 
 ["agentstack-server:dev:start"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = '''
+flag "--vm-name <vm_name>" default="agentstack-local-dev"
+arg "[cli_args]" var=#true
+'''
 run = """
 #!/bin/bash
 set -e
-VM_NAME='{{option(name="vm-name", default="agentstack-local-dev")}}'
+VM_NAME="${usage_vm_name?}"
 eval "$( {{ mise_bin }} run agentstack:shell --vm-name="$VM_NAME" )"
 {{ mise_bin }} run agentstack-server:dev:disconnect --vm-name="$VM_NAME"
 {{ mise_bin }} run agentstack:stop-all --except "$VM_NAME"
@@ -167,26 +173,29 @@ eval "$( {{ mise_bin }} run agentstack:shell --vm-name="$VM_NAME" )"
 
 ["agentstack-server:dev:stop"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'flag "--vm-name <vm_name>" default="agentstack-local-dev"'
 run = """
 #!/bin/bash
-VM_NAME='{{option(name="vm-name", default="agentstack-local-dev")}}'
+VM_NAME="${usage_vm_name?}"
 {{ mise_bin }} run agentstack-server:dev:disconnect --vm-name="$VM_NAME"
 {{ mise_bin }} run agentstack:stop --vm-name="$VM_NAME"
 """
 
 ["agentstack-server:dev:delete"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'flag "--vm-name <vm_name>" default="agentstack-local-dev"'
 run = """
-VM_NAME={{option(name="vm-name", default="agentstack-local-dev")}}
+VM_NAME="${usage_vm_name?}"
 {{ mise_bin }} run agentstack-cli:run -- platform delete --vm-name="$VM_NAME"
 """
 
 ["agentstack-server:dev:connect"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'flag "--vm-name <vm_name>" default="agentstack-local-dev"'
 run = """
 #!/bin/bash
 NAMESPACE=default
-VM_NAME='{{option(name="vm-name", default="agentstack-local-dev")}}'
+VM_NAME="${usage_vm_name?}"
 eval "$( {{ mise_bin }} run agentstack:shell --vm-name="$VM_NAME" )"
 
 tele="telepresence --use .*${NAMESPACE}.*"
@@ -197,10 +206,11 @@ $tele replace agentstack-server --port 18333:8333
 
 ["agentstack-server:dev:disconnect"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'flag "--vm-name <vm_name>" default="agentstack-local-dev"'
 run = """
 #!/bin/bash
 NAMESPACE=default
-VM_NAME='{{option(name="vm-name", default="agentstack-local-dev")}}'
+VM_NAME="${usage_vm_name?}"
 eval "$( {{ mise_bin }} run agentstack:shell --vm-name="$VM_NAME" )"
 
 tele="telepresence --use .*${NAMESPACE}.*"
@@ -212,8 +222,9 @@ $tele quit
 
 ["agentstack-server:dev:reconnect"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'flag "--vm-name <vm_name>" default="agentstack-local-dev"'
 run = """
-VM_NAME='{{option(name="vm-name", default="agentstack-local-dev")}}'
+VM_NAME="${usage_vm_name?}"
 {{ mise_bin }} run agentstack-server:dev:disconnect --vm-name="$VM_NAME"
 {{ mise_bin }} run agentstack-server:dev:connect --vm-name="$VM_NAME"
 """
@@ -224,11 +235,12 @@ run = "uv run pytest -m unit"
 
 ["agentstack-server:test:e2e"]
 dir = "{{config_root}}/apps/agentstack-server"
+usage = 'flag "--no-clean"'
 run = """
 #!/bin/bash
 VM_NAME=e2e-test-run
 
-NO_CLEAN='{{flag(name="no-clean")}}'
+NO_CLEAN="${usage_no_clean:-false}"
 if [ "$NO_CLEAN" != "true" ]; then
     {{ mise_bin }} run agentstack:stop-all
     {{ mise_bin }} run agentstack:delete --vm-name=${VM_NAME}
diff --git a/mise.lock b/mise.lock
index aafe3285c..dffda3f3f 100644
--- a/mise.lock
+++ b/mise.lock
@@ -5,47 +5,37 @@ backend = "asdf:CrouchingMuppet/asdf-lima"
 [[tools.fd]]
 version = "10.3.0"
 backend = "aqua:sharkdp/fd"
+"platforms.macos-arm64" = { checksum = "sha256:0570263812089120bc2a5d84f9e65cd0c25e4a4d724c80075c357239c74ae904", url = "https://github.com/sharkdp/fd/releases/download/v10.3.0/fd-v10.3.0-aarch64-apple-darwin.tar.gz"}
 
-[tools.fd.platforms.macos-arm64]
-checksum = "sha256:0570263812089120bc2a5d84f9e65cd0c25e4a4d724c80075c357239c74ae904"
-size = 1337349
-url = "https://github.com/sharkdp/fd/releases/download/v10.3.0/fd-v10.3.0-aarch64-apple-darwin.tar.gz"
+[[tools."github:google/addlicense"]]
+version = "1.2.0"
+backend = "github:google/addlicense"
+"platforms.macos-arm64" = { checksum = "sha256:0597305c619f7349748e830e38322dbe7d13cf86cf415b289c70f5cecbb4bf63", url = "https://github.com/google/addlicense/releases/download/v1.2.0/addlicense_v1.2.0_macOS_arm64.tar.gz", url_api = "https://api.github.com/repos/google/addlicense/releases/assets/282300420"}
+
+[[tools."github:telepresenceio/telepresence"]]
+version = "2.25.2"
+backend = "github:telepresenceio/telepresence"
+"platforms.macos-arm64" = { checksum = "sha256:79aa444eb9ef05ff64c0e6c04e97bef1460f3ae4800c191798996bdad71c8ec9", url = "https://github.com/telepresenceio/telepresence/releases/download/v2.25.2/telepresence-darwin-arm64", url_api = "https://api.github.com/repos/telepresenceio/telepresence/releases/assets/333205851"}
 
 [[tools.gum]]
 version = "0.17.0"
 backend = "aqua:charmbracelet/gum"
-
-[tools.gum.platforms.macos-arm64]
-checksum = "sha256:e2a4b8596efa05821d8c58d0c1afbcd7ad1699ba69c689cc3ff23a4a99c8b237"
-size = 4395909
-url = "https://github.com/charmbracelet/gum/releases/download/v0.17.0/gum_0.17.0_Darwin_arm64.tar.gz"
+"platforms.macos-arm64" = { checksum = "sha256:e2a4b8596efa05821d8c58d0c1afbcd7ad1699ba69c689cc3ff23a4a99c8b237", url = "https://github.com/charmbracelet/gum/releases/download/v0.17.0/gum_0.17.0_Darwin_arm64.tar.gz"}
 
 [[tools.helm]]
 version = "3.19.0"
 backend = "aqua:helm/helm"
-
-[tools.helm.platforms.macos-arm64]
-checksum = "sha256:31513e1193da4eb4ae042eb5f98ef9aca7890cfa136f4707c8d4f70e2115bef6"
-size = 17058141
-url = "https://get.helm.sh/helm-v3.19.0-darwin-arm64.tar.gz"
+"platforms.macos-arm64" = { checksum = "sha256:31513e1193da4eb4ae042eb5f98ef9aca7890cfa136f4707c8d4f70e2115bef6", url = "https://get.helm.sh/helm-v3.19.0-darwin-arm64.tar.gz"}
 
 [[tools.kubeconform]]
 version = "0.7.0"
 backend = "aqua:yannh/kubeconform"
-
-[tools.kubeconform.platforms.macos-arm64]
-checksum = "sha256:b5d32b2cb77f9c781c976b20a85e2d0bc8f9184d5d1cfe665a2f31a19f99eeb9"
-size = 7031569
-url = "https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-darwin-arm64.tar.gz"
+"platforms.macos-arm64" = { checksum = "sha256:b5d32b2cb77f9c781c976b20a85e2d0bc8f9184d5d1cfe665a2f31a19f99eeb9", url = "https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-darwin-arm64.tar.gz"}
 
 [[tools.node]]
 version = "22.19.0"
 backend = "core:node"
-
-[tools.node.platforms.macos-arm64]
-checksum = "sha256:c59006db713c770d6ec63ae16cb3edc11f49ee093b5c415d667bb4f436c6526d"
-size = 47739366
-url = "https://nodejs.org/dist/v22.19.0/node-v22.19.0-darwin-arm64.tar.gz"
+"platforms.macos-arm64" = { checksum = "sha256:c59006db713c770d6ec63ae16cb3edc11f49ee093b5c415d667bb4f436c6526d", url = "https://nodejs.org/dist/v22.19.0/node-v22.19.0-darwin-arm64.tar.gz"}
 
 [[tools."pipx:toml-cli"]]
 version = "0.8.2"
@@ -54,40 +44,24 @@ backend = "pipx:toml-cli"
 [[tools.pnpm]]
 version = "10.15.1"
 backend = "aqua:pnpm/pnpm"
-
-[tools.pnpm.platforms.macos-arm64]
-checksum = "sha256:b64bd9e75d92934251bd0b890d3d4d1073e85d71bf39227ff6a6408d27c3106d"
-size = 62649648
-url = "https://github.com/pnpm/pnpm/releases/download/v10.15.1/pnpm-macos-arm64"
+"platforms.macos-arm64" = { checksum = "sha256:b64bd9e75d92934251bd0b890d3d4d1073e85d71bf39227ff6a6408d27c3106d", url = "https://github.com/pnpm/pnpm/releases/download/v10.15.1/pnpm-macos-arm64"}
 
 [[tools."ubi:google/addlicense"]]
 version = "1.2.0"
 backend = "ubi:google/addlicense"
-
-[tools."ubi:google/addlicense".platforms.macos-arm64-addlicense]
-checksum = "blake3:29c4b12b602b33cf8b88b2f947741bdbd60516afd72d9585abc95912fbeca47a"
+"platforms.macos-arm64-addlicense" = { checksum = "blake3:29c4b12b602b33cf8b88b2f947741bdbd60516afd72d9585abc95912fbeca47a"}
 
 [[tools."ubi:telepresenceio/telepresence"]]
 version = "2.24.1"
 backend = "ubi:telepresenceio/telepresence"
-
-[tools."ubi:telepresenceio/telepresence".platforms.macos-arm64-telepresence]
-checksum = "blake3:1d8fc5495ba38b306e2b7b01da21446312eb6fe2111c83d520a56fa5a0b69cb5"
+"platforms.macos-arm64-telepresence" = { checksum = "blake3:1d8fc5495ba38b306e2b7b01da21446312eb6fe2111c83d520a56fa5a0b69cb5"}
 
 [[tools.uv]]
 version = "0.9.5"
 backend = "aqua:astral-sh/uv"
-
-[tools.uv.platforms.macos-arm64]
-checksum = "sha256:dc098ff224d78ed418e121fd374f655949d2c7031a70f6f6604eaf016a130433"
-size = 18341942
-url = "https://github.com/astral-sh/uv/releases/download/0.9.5/uv-aarch64-apple-darwin.tar.gz"
+"platforms.macos-arm64" = { checksum = "sha256:dc098ff224d78ed418e121fd374f655949d2c7031a70f6f6604eaf016a130433", url = "https://github.com/astral-sh/uv/releases/download/0.9.5/uv-aarch64-apple-darwin.tar.gz"}
 
 [[tools.yq]]
 version = "4.47.2"
 backend = "aqua:mikefarah/yq"
-
-[tools.yq.platforms.macos-arm64]
-checksum = "sha256:4ccc7f2f5f6f37804d70ad211a287b1b589f67024ecb77586c77106030424b9f"
-size = 10980754
-url = "https://github.com/mikefarah/yq/releases/download/v4.47.2/yq_darwin_arm64"
+"platforms.macos-arm64" = { checksum = "sha256:4ccc7f2f5f6f37804d70ad211a287b1b589f67024ecb77586c77106030424b9f", url = "https://github.com/mikefarah/yq/releases/download/v4.47.2/yq_darwin_arm64"}
diff --git a/mise.toml b/mise.toml
index 21a638f88..b55f51d05 100644
--- a/mise.toml
+++ b/mise.toml
@@ -12,13 +12,13 @@ pnpm = "10.15.1"
 # Kubernetes
 helm = "latest"
 kubeconform = "latest"
-"ubi:telepresenceio/telepresence" = "latest"
+"github:telepresenceio/telepresence" = "latest"
 
 # misc
 yq = "latest"
 "pipx:toml-cli" = "latest"
 fd = "latest"
-"ubi:google/addlicense" = "latest"
+"github:google/addlicense" = "latest"
 gum = "latest"
 
 [settings]
@@ -26,6 +26,7 @@ experimental = true # for python.uv_venv_auto
 python.uv_venv_auto = true
 raw = true
 node.gpg_verify = false # tends to randomly fail; sha is checked by lockfile
+task.disable_spec_from_run_scripts = true # opt-in to new task behavior
 
 [hooks]
 postinstall = [
diff --git a/tasks.toml b/tasks.toml
index 228e0f038..b5650a0e7 100644
--- a/tasks.toml
+++ b/tasks.toml
@@ -137,11 +137,12 @@ run = "{{ mise_bin }} run agentstack-cli:run -- platform delete"
 run = "{{ mise_bin }} run agentstack-cli:run -- platform stop"
 
 ["agentstack:stop-all"]
+usage = 'flag "--except <except>" default=""'
 run = """
 #!/bin/bash
 # Stop all lima VMs
 
-EXCEPT='{{option(name="except", default="")}}'
+EXCEPT="${usage_except?}"
 
 {% raw %}
 TO_STOP="$(LIMA_HOME=~/.agentstack/lima limactl list -f '{{.Name}};{{.Status}}' | grep -v "Stopped" | cut -d';' -f1 2>/dev/null | sed '/^[^a-z]*$/d' | sed "/^$EXCEPT$/d")"
@@ -154,16 +155,17 @@ echo "$TO_STOP" | xargs -rn 1 -I"{}" mise run agentstack-cli:run -- platform sto
 
 ["agentstack:shell"]
 raw = true
-shell = "echo"
 dir = "{{cwd}}"
+usage = 'flag "--vm-name <vm_name>" default="agentstack"'
 run = """
+cat <<EOF
 deactivate () {
-  export PS1="$__OLD_PS1"
+  export PS1="\\$__OLD_PS1"
 
   # Restore LIMA_HOME to its original state (set or unset)
-  [[ -n "$__OLD_LIMA_HOME" ]] && export LIMA_HOME="$__OLD_LIMA_HOME" || unset LIMA_HOME
-  [[ -n "$__OLD_KUBECONFIG" ]] && export KUBECONFIG="$__OLD_KUBECONFIG" || unset KUBECONFIG
-  [[ -n "$__OLD_ADMIN_PASSWORD" ]] && export AGENTSTACK__ADMIN_PASSWORD="$__OLD_ADMIN_PASSWORD" || unset AGENTSTACK__ADMIN_PASSWORD
+  [[ -n "\\$__OLD_LIMA_HOME" ]] && export LIMA_HOME="\\$__OLD_LIMA_HOME" || unset LIMA_HOME
+  [[ -n "\\$__OLD_KUBECONFIG" ]] && export KUBECONFIG="\\$__OLD_KUBECONFIG" || unset KUBECONFIG
+  [[ -n "\\$__OLD_ADMIN_PASSWORD" ]] && export AGENTSTACK__ADMIN_PASSWORD="\\$__OLD_ADMIN_PASSWORD" || unset AGENTSTACK__ADMIN_PASSWORD
 
   # Clean up the backup values
   unset __OLD_PS1
@@ -171,25 +173,25 @@ deactivate () {
   unset __OLD_KUBECONFIG
   unset __OLD_ADMIN_PASSWORD
   unset -f deactivate
-  echo "Environment for '$VM_NAME' deactivated."
+  echo "Environment for '${usage_vm_name?}' deactivated."
 }
 
-while [[ -n "$__OLD_PS1" ]]; do
+while [[ -n "\\$__OLD_PS1" ]]; do
   deactivate;
 done
 
-VM_NAME={{option(name="vm-name", default="agentstack")}}
-echo "Activating environment for '$VM_NAME'..."
+echo "Activating environment for '${usage_vm_name?}'..."
 
-export __OLD_PS1="$PS1"
-export __OLD_LIMA_HOME="$LIMA_HOME"
-export __OLD_KUBECONFIG="$KUBECONFIG"
-export __OLD_ADMIN_PASSWORD="$AGENTSTACK__ADMIN_PASSWORD"
+export __OLD_PS1="\\$PS1"
+export __OLD_LIMA_HOME="\\$LIMA_HOME"
+export __OLD_KUBECONFIG="\\$KUBECONFIG"
+export __OLD_ADMIN_PASSWORD="\\$AGENTSTACK__ADMIN_PASSWORD"
 
-export KUBECONFIG="${AGENTSTACK__HOME:-${HOME}/.agentstack}/lima/${VM_NAME}/copied-from-guest/kubeconfig.yaml"
-export LIMA_HOME=${AGENTSTACK__HOME:-${HOME}/.agentstack}/lima
+export KUBECONFIG="\\${AGENTSTACK__HOME:-\\${HOME}/.agentstack}/lima/${usage_vm_name?}/copied-from-guest/kubeconfig.yaml"
+export LIMA_HOME=\\${AGENTSTACK__HOME:-\\${HOME}/.agentstack}/lima
 export AGENTSTACK__ADMIN_PASSWORD=test-password
-export PS1="(${VM_NAME}) ${__OLD_PS1}"
+export PS1="(${usage_vm_name?}) \\${__OLD_PS1}"
+EOF
 """
 
 # release tasks
@@ -427,11 +429,12 @@ echo -e "✅ Published \x1b[36mstable\x1b[0m docs for \x1b[36mv$publish_version\
 ["sync-images-to-ghcr"]
 dir = "{{config_root}}"
 depends = ["helm:build:dependencies"]
+usage = "flag --dryrun"
 run = '''
 #!/bin/bash
 
 set -euo pipefail
-DRY_RUN='{{flag(name='dryrun')}}'
+DRY_RUN="${usage_dryrun:-false}"
 
 {% raw %}
 echo "Extracting images from helm chart..."