diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fcd5400..92b8d7d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
diff --git a/.mise.toml b/.mise.toml
new file mode 100644
index 0000000..2a1df48
--- /dev/null
+++ b/.mise.toml
@@ -0,0 +1,10 @@
+[tools]
+# = "SPDX-License-Identifier: MPL-2.0"
+# = "asdf version management"
+# = "Run asdf install to install all tools"
+# = "Primary build tool"
+zig = "0.13.0"
+# = "Task runner"
+just = "1.36.0"
+# = "Rust (for shim)"
+rust = "nightly"
diff --git a/.tool-versions b/.tool-versions
deleted file mode 100644
index cecc7c4..0000000
--- a/.tool-versions
+++ /dev/null
@@ -1,12 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# asdf version management
-# Run 'asdf install' to install all tools
-
-# Primary build tool
-zig 0.13.0
-
-# Task runner
-just 1.36.0
-
-# Rust (for shim)
-rust nightly