diff --git a/mise.agent.toml b/mise.agent.toml
new file mode 100644
index 000000000..6ce1b9430
--- /dev/null
+++ b/mise.agent.toml
@@ -0,0 +1,37 @@
+[env]
+DEVSY_GIT_SIGNING_PRIVATE_KEY = { age = "YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTHlMQmxra00yOWRKTUI0bithV0xtNkVwRXVreDFPT1BYR1UzN1VXdHo4CnVSOVdYUDdPeGJFSjFrN0lkQjBVRndheUhwRjdKNitlWVBYSEgrMEp3YzAKLT4gP0xhOi0tZ3JlYXNlIDUoYiBqaFUgbUsjIHooSXM9ajgqCm84VDdsS3ZtcEk0UkhQUHVXQzhCbmxpSXBkSmh0eTVNV25VNGZhYUJ5SER6NUFiZE03WDRFV212YkVRCi0tLSA2dmZZK3QzZFpGRDY5a29hQ2t4dnhyemJjMlFaVU9ncmdmeTlYbUVNTkFRCuB0Lsu02r99Y/DkyFleuWJzSoCVggBIG1Se9AD04rF38nRhmAXSDk5G7s2BGW2fWs8HSsrohaaMS2EmTxFx/FlGXHzaqlxLXhxvDErI2oU/oqXKNtEKVTMYo5LzHTCRovVKVR+ELDpkTpClYoQi17ukjMXelOZRsEQ6wDhiO/3YXqcX738Kh7rzdqA2W3CgYOxLjoYnBtHL0dzsXpFj339mCOI/naDgCn5lfMiNplqlTuGG2RO/f+nfT9/c0+QtibWaAuq2OwNb/kzQctPFFBg4YeAjraMtgWuBYEau6S8juGgF6DsPpC1emUpAIZHibyFaIDuLYBWyjgZ1GJUC4ZztJ+uYHdFewSlgXT2xXNfOS2fASaxi9A1wpkcjbuIXqv6aGIkZL16/JeBBFLzyrPuEy7rIqG/ly1IYWSi7RUJuMay6m02FD6uJzlp8Yo1S+AgAvFFNP1nzlUlE5Cu/+ffhmp1soHqY53LptCf/OyS74Emcu/L9eaa99X1SsZE7J+aOnwatDaPBBR/KCp96q8oTbMxKiEq+ZP6CzAlukzGS9nI" }
+
+[tasks."setup:agent"]
+run = '''
+set -eu
+if [ -z "$DEVSY_GIT_SIGNING_PRIVATE_KEY" ]; then
+  echo "DEVSY_GIT_SIGNING_PRIVATE_KEY is not set"
+  exit 1
+fi
+if [ -z "$DEVSY_GIT_AUTHOR_NAME" ]; then
+  echo "DEVSY_GIT_AUTHOR_NAME is not set"
+  exit 1
+fi
+if [ -z "$DEVSY_GIT_AUTHOR_EMAIL" ]; then
+  echo "DEVSY_GIT_AUTHOR_EMAIL is not set"
+  exit 1
+fi
+SIGNING_DIR="$HOME/.local/share/devsy/signing"
+SIGNING_PRIVATE_KEY="$SIGNING_DIR/devsy-agent-signing"
+SIGNING_PUBLIC_KEY="$SIGNING_DIR/devsy-agent-signing.pub"
+
+mkdir -p "$SIGNING_DIR"
+chmod 700 "$SIGNING_DIR"
+
+echo "$DEVSY_GIT_SIGNING_PRIVATE_KEY" > "$SIGNING_PRIVATE_KEY"
+chmod 600 "$SIGNING_PRIVATE_KEY"
+
+ssh-keygen -y -f "$SIGNING_PRIVATE_KEY" > "$SIGNING_PUBLIC_KEY"
+
+git config --global gpg.format ssh
+git config --global user.signingkey "$SIGNING_PUBLIC_KEY"
+git config --global commit.gpgsign true
+git config --global tag.gpgsign true
+git config --global user.name "$DEVSY_GIT_AUTHOR_NAME"
+git config --global user.email "$DEVSY_GIT_AUTHOR_EMAIL"
+'''
diff --git a/mise.lock b/mise.lock
new file mode 100644
index 000000000..984c8e0ff
--- /dev/null
+++ b/mise.lock
@@ -0,0 +1,74 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
+
+lockfile_version = 1
+
+[[tools.gh]]
+version = "2.100.0"
+backend = "aqua:cli/cli"
+specifiers = ["2.100.0"]
+
+[tools.gh."platforms.linux-x64"]
+checksum = "sha256:e4d4bb4498e8d007abe545b6568926793ace1b6447da598294a610018cb164be"
+url = "https://github.com/cli/cli/releases/download/v2.100.0/gh_2.100.0_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/542974264"
+provenance = "github-attestations"
+
+[[tools.go]]
+version = "1.26.5"
+backend = "core:go"
+specifiers = ["1.26.5"]
+
+[tools.go."platforms.linux-x64"]
+checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
+url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
+
+[[tools.golangci-lint]]
+version = "2.12.2"
+backend = "aqua:golangci/golangci-lint"
+specifiers = ["2.12.2"]
+
+[tools.golangci-lint."platforms.linux-x64"]
+checksum = "sha256:8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553"
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz"
+url_api = "https://api.github.com/repos/golangci/golangci-lint/releases/assets/413471054"
+provenance = "github-attestations"
+
+[[tools.node]]
+version = "24.20.0"
+backend = "core:node"
+specifiers = ["24"]
+
+[tools.node."platforms.linux-x64"]
+checksum = "sha256:855d581f8a4eb1a8117e3426de25fe02770592febcfb31369aee1ffbfee9e8ec"
+url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.gz"
+
+[[tools.prek]]
+version = "0.5.2"
+backend = "aqua:j178/prek"
+specifiers = ["0.5.2"]
+
+[tools.prek."platforms.linux-x64"]
+checksum = "sha256:a4d51a463cb15ee2929368cc4884eec4ef33dce3ff5101b40e8ad7e1205b8f40"
+url = "https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/j178/prek/releases/assets/541547346"
+provenance = "github-attestations"
+
+[[tools.protoc]]
+version = "36.1"
+backend = "aqua:protocolbuffers/protobuf/protoc"
+specifiers = ["36.1"]
+
+[tools.protoc."platforms.linux-x64"]
+checksum = "sha256:c4bc672d9d49214dc8cafdceadf4df92182d6ca8e3ec65a56b2d7de5602669b4"
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v36.1/protoc-36.1-linux-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/538583183"
+
+[[tools.task]]
+version = "3.53.1"
+backend = "aqua:go-task/task"
+specifiers = ["3.53.1"]
+
+[tools.task."platforms.linux-x64"]
+checksum = "sha256:a54a408f6861ff921f6e87774180db31bacd8c1e7c944ca696db9fea49a82fc7"
+url = "https://github.com/go-task/task/releases/download/v3.53.1/task_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/go-task/task/releases/assets/519645449"
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 000000000..51ef2f3c1
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,31 @@
+[settings]
+experimental = true
+lockfile = true
+lockfile_platforms = ["linux-x64"]
+
+[tool_config]
+locked = true
+
+[tools]
+go = "1.26.5"
+node = "24"
+task = "3.53.1"
+golangci-lint = "2.12.2"
+prek = "0.5.2"
+protoc = "36.1"
+gh = "2.100.0"
+
+[tasks.setup]
+depends = ["setup:dependencies", "setup:hooks"]
+
+[tasks."setup:dependencies"]
+run = '''
+go mod download
+npm ci
+(cd desktop && npm ci)
+'''
+
+[tasks."setup:hooks"]
+run = '''
+prek install
+'''