diff --git a/.config/mise.toml b/.config/mise.toml
index 3b381eb0..52f439ac 100644
--- a/.config/mise.toml
+++ b/.config/mise.toml
@@ -10,7 +10,7 @@ PULUMI_HOME = "{{config_root}}/.pulumi"
 # Runtimes
 go = "{{ env.GO_VERSION_MISE }}"
 node = '24.18.0'
-python = '3.11.8'
+python = '3.11.15'
 "vfox:version-fox/vfox-dotnet" = "8.0.20" # vfox backend doesn't work on Windows, gives "error converting Lua table to PreInstall (no version returned from vfox plugin)" https://github.com/jdx/mise/discussions/5876 https://github.com/jdx/mise/discussions/5550
 # Corretto version used as Java SE/OpenJDK version no longer offered
 java = 'corretto-11'
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b98dc0b0..e5479573 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,7 +19,7 @@ env:
   TRAVIS_OS_NAME: linux
   GOVERSION: "1.21.x"
   NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
+  PYTHONVERSION: "3.11.15"
   DOTNETVERSION: "8.0.x"
   JAVAVERSION: "11"
   PULUMI_API: https://api.pulumi-staging.io
diff --git a/.github/workflows/community-moderation.yml b/.github/workflows/community-moderation.yml
index 373c31b9..0d3d5653 100644
--- a/.github/workflows/community-moderation.yml
+++ b/.github/workflows/community-moderation.yml
@@ -11,13 +11,13 @@ jobs:
         persist-credentials: false
     - id: schema_changed
       name: Check for diff in schema
-      uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
       with:
         filters: "changed: 'provider/cmd/**/schema.json'"
     - id: sdk_changed
       if: steps.schema_changed.outputs.changed == 'false'
       name: Check for diff in sdk/**
-      uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
       with:
         filters: "changed: 'sdk/**'"
     - if: steps.sdk_changed.outputs.changed == 'true' &&
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index c0981bb2..6d73c8c0 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -10,7 +10,7 @@ env:
   TRAVIS_OS_NAME: linux
   GOVERSION: "1.21.x"
   NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
+  PYTHONVERSION: "3.11.15"
   DOTNETVERSION: "8.0.x"
   JAVAVERSION: "11"
   PULUMI_API: https://api.pulumi-staging.io
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5c335743..d5228bae 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ env:
   TRAVIS_OS_NAME: linux
   GOVERSION: "1.21.x"
   NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
+  PYTHONVERSION: "3.11.15"
   DOTNETVERSION: "8.0.x"
   JAVAVERSION: "11"
   PULUMI_API: https://api.pulumi-staging.io
diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index 6101892e..37ca27ec 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -14,7 +14,7 @@ env:
   TRAVIS_OS_NAME: linux
   GOVERSION: "1.21.x"
   NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
+  PYTHONVERSION: "3.11.15"
   DOTNETVERSION: "8.0.x"
   JAVAVERSION: "11"
   PULUMI_API: https://api.pulumi-staging.io
diff --git a/.github/workflows/weekly-pulumi-update.yml b/.github/workflows/weekly-pulumi-update.yml
index 260b3876..97ad8e8b 100644
--- a/.github/workflows/weekly-pulumi-update.yml
+++ b/.github/workflows/weekly-pulumi-update.yml
@@ -11,7 +11,7 @@ env:
   TRAVIS_OS_NAME: linux
   GOVERSION: "1.21.x"
   NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
+  PYTHONVERSION: "3.11.15"
   DOTNETVERSION: "8.0.x"
   JAVAVERSION: "11"
   PULUMI_API: https://api.pulumi-staging.io
diff --git a/.openinspect/README.md b/.openinspect/README.md
new file mode 100644
index 00000000..7c838d89
--- /dev/null
+++ b/.openinspect/README.md
@@ -0,0 +1,32 @@
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+
+# OpenInspect Setup
+
+This directory contains the default OpenInspect setup for Pulumi provider repositories managed by `ci-mgmt`.
+
+## Generated Files
+
+- `settings.json` is generated from `ci-mgmt` defaults plus any `.ci-mgmt.yaml` `openinspect.settings` values.
+- `setup.py` installs `mise`, trusts the repo config, installs repo tools, and runs setup hooks.
+- `setup.d/*.py` files may be generated by more specific templates.
+
+## Customizing Settings
+
+Do not edit `settings.json` directly. Add settings in the provider repository's `.ci-mgmt.yaml` instead:
+
+```yaml
+openinspect:
+  settings:
+    exampleField: exampleValue
+```
+
+`ci-mgmt` preserves the default `pathPrepend` setting unless the provider explicitly overrides it.
+
+## Customizing Setup
+
+Do not edit `setup.py` directly. Add provider-owned setup code in one of these files:
+
+- `.openinspect/setup.d/*.py`
+- `.openinspect/setup.local.py`
+
+Hooks in `setup.d` run in sorted filename order. `setup.local.py` runs after `setup.d`.
diff --git a/.openinspect/settings.json b/.openinspect/settings.json
new file mode 100644
index 00000000..86c1b965
--- /dev/null
+++ b/.openinspect/settings.json
@@ -0,0 +1,5 @@
+{
+  "pathPrepend": [
+    "~/.local/share/mise/shims"
+  ]
+}
diff --git a/.openinspect/setup.py b/.openinspect/setup.py
new file mode 100644
index 00000000..177c0dc2
--- /dev/null
+++ b/.openinspect/setup.py
@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+"""
+Runs once on fresh OpenInspect sandbox boot.
+
+Boot sequence:
+  1. Install mise, trust the repo config, and install repo tools.
+  2. Run generated and repo-local setup hooks:
+     - .openinspect/setup.d/*.py
+     - .openinspect/setup.local.py
+"""
+
+import logging
+import os
+import shutil
+import subprocess
+import sys
+import time
+from contextlib import contextmanager
+from pathlib import Path
+
+
+log = logging.getLogger("setup")
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s [%(phase)s] %(message)s",
+    datefmt="%H:%M:%S",
+    stream=sys.stdout,
+)
+
+_log_factory = logging.getLogRecordFactory()
+_current_phase = "setup"
+
+
+def _record_factory(*args, **kwargs):
+    record = _log_factory(*args, **kwargs)
+    record.phase = _current_phase
+    return record
+
+
+logging.setLogRecordFactory(_record_factory)
+
+
+@contextmanager
+def phase(name: str, description: str = ""):
+    global _current_phase
+    prev = _current_phase
+    _current_phase = name
+    label = description or name
+    log.info("Starting: %s", label)
+    t0 = time.monotonic()
+    try:
+        yield
+    except Exception:
+        elapsed = time.monotonic() - t0
+        log.error("FAILED after %.1fs: %s", elapsed, label)
+        raise
+    else:
+        elapsed = time.monotonic() - t0
+        log.info("Done in %.1fs: %s", elapsed, label)
+    finally:
+        _current_phase = prev
+
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+OPENINSPECT_DIR = REPO_ROOT / ".openinspect"
+
+
+def run(cmd, **kwargs):
+    cmd_str = cmd if isinstance(cmd, str) else " ".join(cmd)
+    log.info("$ %s", cmd_str)
+    kwargs.setdefault("check", True)
+    kwargs.setdefault("cwd", REPO_ROOT)
+    return subprocess.run(cmd, shell=isinstance(cmd, str), **kwargs)
+
+
+def setup_mise():
+    os.environ.setdefault("MISE_FETCH_REMOTE_VERSIONS_TIMEOUT", "10m")
+    os.environ.setdefault("MISE_HTTP_TIMEOUT", "10m")
+
+    if not shutil.which("mise"):
+        run("curl -fsSL https://mise.run | MISE_INSTALL_PATH=/usr/local/bin/mise sh")
+    else:
+        log.info("mise already installed, skipping download")
+
+    run("mise trust --yes")
+    run("mise install --yes")
+
+    mise_data = os.environ.get(
+        "MISE_DATA_DIR", os.path.expanduser("~/.local/share/mise")
+    )
+    shims = f"{mise_data}/shims"
+    if shims not in os.environ.get("PATH", ""):
+        os.environ["PATH"] = f"{shims}:{os.environ.get('PATH', '')}"
+
+    export_line = f'export PATH="{shims}:$PATH"'
+    for rc in [Path.home() / ".bashrc", Path.home() / ".profile"]:
+        if rc.exists() and export_line in rc.read_text():
+            continue
+        with open(rc, "a") as f:
+            f.write(f"\n# Added by .openinspect/setup.py - mise shims\n{export_line}\n")
+
+
+def run_hook(path: Path):
+    run([sys.executable, str(path)])
+
+
+def run_setup_hooks():
+    hooks_dir = OPENINSPECT_DIR / "setup.d"
+    if hooks_dir.exists():
+        for hook in sorted(hooks_dir.glob("*.py")):
+            with phase("hook", f"Run {hook.relative_to(REPO_ROOT)}"):
+                run_hook(hook)
+
+    local_hook = OPENINSPECT_DIR / "setup.local.py"
+    if local_hook.exists():
+        with phase("hook", f"Run {local_hook.relative_to(REPO_ROOT)}"):
+            run_hook(local_hook)
+
+
+if __name__ == "__main__":
+    t_total = time.monotonic()
+    log.info("=== Sandbox setup starting ===")
+
+    with phase("mise", "Install mise and trust repo config"):
+        setup_mise()
+
+    run_setup_hooks()
+
+    elapsed_total = time.monotonic() - t_total
+    minutes = int(elapsed_total // 60)
+    seconds = int(elapsed_total % 60)
+    log.info("=== Sandbox setup complete in %dm%ds ===", minutes, seconds)