diff --git a/.devcontainer/sandbox-mise/devcontainer.json b/.devcontainer/sandbox-mise/devcontainer.json
index 1c1b956..a179fd0 100644
--- a/.devcontainer/sandbox-mise/devcontainer.json
+++ b/.devcontainer/sandbox-mise/devcontainer.json
@@ -6,7 +6,7 @@
       // renovate: datasource=docker registryUrl=https://ghcr.io depName=bare-devcontainer/debian versioning=debian
       "DEBIAN_TAG": "trixie-20260711@sha256:a4016263075479795268ddc3f312d4ce487d6599cd24f537d441ece216bf4677",
       // renovate: datasource=github-releases depName=jdx/mise versioning=semver
-      "MISE_VERSION": "2026.6.12"
+      "MISE_VERSION": "2026.7.5"
     }
   },
   "runArgs": [
diff --git a/.devcontainer/sandbox-uv/devcontainer.json b/.devcontainer/sandbox-uv/devcontainer.json
index 231baf7..de4bce6 100644
--- a/.devcontainer/sandbox-uv/devcontainer.json
+++ b/.devcontainer/sandbox-uv/devcontainer.json
@@ -6,8 +6,8 @@
       // renovate: datasource=docker registryUrl=https://ghcr.io depName=bare-devcontainer/debian versioning=debian
       "DEBIAN_TAG": "trixie-20260711@sha256:a4016263075479795268ddc3f312d4ce487d6599cd24f537d441ece216bf4677",
       // renovate: datasource=github-releases depName=astral-sh/uv versioning=semver
-      "UV_VERSION": "0.11.26",
-      // renovate: datasource=github-releases depName=cli/cli versioning=semver extractVersion=^v?(?<version>.+)
+      "UV_VERSION": "0.11.28",
+      // renovate: datasource=deb registryUrl=https://cli.github.com/packages?suite=stable&components=main&binaryArch=amd64 depName=gh versioning=deb
       "GH_VERSION": "2.96.0"
     }
   },
diff --git a/renovate.jsonc b/renovate.jsonc
index c645089..73f45aa 100644
--- a/renovate.jsonc
+++ b/renovate.jsonc
@@ -28,7 +28,12 @@
         "// renovate: datasource=(?<datasource>\\S+)( registryUrl=(?<registryUrl>\\S+))? depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?[\\s\\S]*?\"(?<currentValue>[^\"@]+)@(?<currentDigest>sha256:[a-f0-9]+)\"",
         // JSON string following a `// renovate:` comment in the form `"name@version"` (no sha256 digest)
         // e.g. "anthropic.claude-code@2.1.168"
-        "// renovate: datasource=(?<datasource>\\S+)( registryUrl=(?<registryUrl>\\S+))? depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?[\\s\\S]*?\"[^\"@]+@(?<currentValue>[^\":]+)\""
+        "// renovate: datasource=(?<datasource>\\S+)( registryUrl=(?<registryUrl>\\S+))? depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?[\\s\\S]*?\"[^\"@]+@(?<currentValue>[^\":]+)\"",
+        // JSON key-value pair following a `// renovate:` comment where the value is a
+        // plain version string (no `@`). Skips the quoted key first so currentValue
+        // captures the value, not the key.
+        // e.g. "MISE_VERSION": "2026.6.12"
+        "// renovate: datasource=(?<datasource>\\S+)( registryUrl=(?<registryUrl>\\S+))? depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?( extractVersion=(?<extractVersion>\\S+))?[\\s\\S]*?\"[^\"]+\":\\s*\"(?<currentValue>[^@\"\\s]+)\""
       ],
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
     },