diff --git a/.mise/config.maint.toml b/.mise/config.maint.toml
index 0e2c786..3112bd5 100644
--- a/.mise/config.maint.toml
+++ b/.mise/config.maint.toml
@@ -567,7 +567,7 @@ run = """
 coreutils="$(mise which coreutils)"
 crane="$(mise which crane)"
 gh="$(mise which gh)"
-GITHUB_TOKEN="${GITHUB_TOKEN:-$("$gh" auth token)}"
+GITHUB_TOKEN="${GITHUB_TOKEN:-$("$gh" auth token)}" # skipcq: SCT-A000 -- gh-auth fallback, no literal secret
 export GITHUB_TOKEN
 ref="ghcr.io/edge-toolkit/core/mise-tools/linux-x64:latest"
 out="target/scratch/mise-oci-linux-x64"
diff --git a/.mise/config.python.toml b/.mise/config.python.toml
index 0a47822..5fa3599 100644
--- a/.mise/config.python.toml
+++ b/.mise/config.python.toml
@@ -23,6 +23,24 @@ ruff = "latest"
 # only published as a tarball on GitHub releases. The extracted tarball contains a top-level `pyodide/`
 # directory the modules service picks up -- see `default_modules_folders` in libs/edge-toolkit/src/config.rs.
 [tools."http:pyodide"]
+# Keep every pyodide executable OFF the task PATH.
+# The dist root carries `python` / `python.bat` / `python.exe` wrapper scripts, and with no bin_path set
+# mise's http backend falls back to putting the whole install root on PATH (no bin/ dir, executables at the
+# root). On the Windows CI lane the GHCR tool store restores http:pyodide before core python exists -- the
+# store excludes python as non-relocatable, and preinstall's own bootstrap install list doesn't include it --
+# so preinstall's `command -v python` pipx bootstrap found pyodide's wrapper and died with
+#
+#     Cannot find pyodide pip. Make a pyodide venv first?
+#
+# on commit 5fb4626293685ee13b2da3b19686830ec5833cbb at
+# https://github.com/edge-toolkit/core/actions/runs/31864076908/job/94962233487, passing only on the retry
+# step once the full `mise install` had put real CPython on PATH. Nothing runs pyodide from PATH (the modules
+# service reads the install dir straight off disk), so point bin_path at a deliberately nonexistent subdir --
+# the http backend returns it without an existence check, which yields an inert PATH entry. Setting bin_path
+# also disables the backend's single-top-level-directory auto-strip detection, so strip_components is pinned
+# to keep the flat extract layout the modules service reads.
+bin_path = "no-bins-on-path"
+strip_components = "1"
 url = "https://github.com/pyodide/pyodide/releases/download/{{ version }}/pyodide-{{ version }}.tar.bz2"
 version = "0.29.3"
 
diff --git a/.mise/config.toml b/.mise/config.toml
index cae302d..7119a27 100644
--- a/.mise/config.toml
+++ b/.mise/config.toml
@@ -1380,19 +1380,29 @@ run = "mise install coreutils crane gh aqua:01mf02/jaq"
 # backends, and lives here rather than in config.maint.toml because the docker publisher runs it INSIDE the
 # build container, where only the always-loaded configs exist.
 #
-# A tool is relocatable when its install tree is a plain extracted archive: aqua, github, http and ubi all
-# unpack a tarball and stop, so moving the tree to another machine's data dir works. Every other backend
-# writes the publishing machine's absolute paths into the tree at install time, which then breaks on a
-# consumer whose $HOME differs -- conda emits `.mise-bins/<tool>` wrappers holding
+# A tool is relocatable when its install tree carries no machine-specific absolute paths. aqua, github, http
+# and ubi unpack an archive and stop, so moving the tree to another machine's data dir works. The go, java,
+# node and zig core runtimes are the same shape -- a plain toolchain-archive extract, each locating its own
+# libs relative to the running binary (or, for java, to JAVA_HOME) -- except for one absolute artifact, the
+# macOS Contents/Home convenience symlink mise creates at java install time, which the body below repoints
+# to a relative target. cargo: tools ride along too -- cargo-binstall drops plain prebuilt binaries under
+# bin/, and the .crates.toml / .crates2.json metadata beside them records only crate names and versions -- as
+# do go: tools, which are single self-contained static executables. The rust core runtime can NOT join them:
+# mise never materialises rust under installs/ at all -- installs/rust/<ver> is an absolute symlink into
+# $CARGO_HOME/bin and the toolchain itself lives in $RUSTUP_HOME (both outside the data dir), so a rust layer
+# would carry nothing but a dangling publisher-path symlink. Every other backend writes the publishing
+# machine's absolute paths into the tree at install time, which then breaks on a consumer whose $HOME differs
+# -- conda emits `.mise-bins/<tool>` wrappers holding
 #
 #     export CONDA_PREFIX='/home/<publisher>/.local/share/mise/installs/conda-<tool>/<ver>'
 #     exec '/home/<publisher>/.local/share/mise/installs/conda-<tool>/<ver>/bin/<tool>'
 #
 # so a restored `clang-format` dies with `exec: /home/<publisher>/...: not found` (exit 127), and pipx does
 # the same through venv shebangs + pyvenv.cfg. `mise install` cannot repair those: it treats a tool with an
-# install dir as installed, so a poisoned tree survives every later install. Excluding them costs nothing --
-# the store exists to spare api.github.com the per-tool release/attestation lookups that aqua, github and
-# http tools make, and conda / pipx / cargo / go / core-runtime installs never touch that API.
+# install dir as installed, so a poisoned tree survives every later install. aqua/github/http/ubi earn their
+# place by sparing api.github.com the per-tool release/attestation lookups CI would otherwise repeat; the
+# core runtimes and the cargo:/go: tools never touch that API but are carried because their cold installs are
+# the slow ones (source-build fallbacks, toolchain downloads).
 [tasks.oci-build-store]
 depends = ["_setup-store-tools"]
 description = "Build the mise-tools OCI layout for the current toolset, relocatable backends only"
@@ -1409,11 +1419,23 @@ for tool in $(mise ls --current --json | "$jaq" -r 'keys[]'); do
     *) backend="$(mise registry "$tool" | "$coreutils" head -n1 | "$coreutils" cut -d' ' -f1)" ;;
   esac
   case "$backend" in
-    aqua:* | github:* | http:* | ubi:*) ;;
+    aqua:* | cargo:* | core:go | core:java | core:node | core:zig | github:* | go:* | http:* | ubi:*) ;;
     *) disabled="${disabled:+$disabled,}$tool" ;;
   esac
 done
 echo "store excludes non-relocatable tools: ${disabled:-<none>}"
+# Repoint the macOS java Contents/Home symlink at its version root relatively.
+# The link mise creates at install time is absolute (the publisher's data dir), so it dangles on any consumer
+# whose data dir differs; the relative target resolves identically everywhere. No-op on linux/windows JDK
+# layouts, which have no Contents/.
+installs="${MISE_DATA_DIR:-$HOME/.local/share/mise}/installs"
+for home in "$installs"/java/*/Contents/Home; do
+  if [ -L "$home" ]; then
+    case "$("$coreutils" readlink "$home")" in
+      /*) "$coreutils" ln -sfn .. "$home" ;;
+    esac
+  fi
+done
 MISE_DISABLE_TOOLS="$disabled" MISE_EXPERIMENTAL=1 mise oci build -o "$out"
 """
 shell = "bash -euo pipefail -c"
diff --git a/.mise/mise.lock b/.mise/mise.lock
index e1a1585..a176053 100644
--- a/.mise/mise.lock
+++ b/.mise/mise.lock
@@ -1153,6 +1153,7 @@ checksum = "blake3:80465dac5a67ca0109addee06073e8dcac277bf74083b7756a68c4ab708a2
 url = "https://github.com/rustfs/rustfs/releases/download/1.0.0-beta.12/rustfs-linux-x86_64-musl-v1.0.0-beta.12.zip"
 
 [tools."http:rustfs"."platforms.macos-arm64"]
+checksum = "blake3:171658d8a364d5a43a8b316ab7977aa8cd6e7badac2e3b1162f3e99d5f88c488"
 url = "https://github.com/rustfs/rustfs/releases/download/1.0.0-beta.12/rustfs-macos-aarch64-v1.0.0-beta.12.zip"
 
 [tools."http:rustfs"."platforms.windows-x64"]