diff --git a/README.md b/README.md
index bce15c70d..38805cbc3 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-![Coverage](https://img.shields.io/badge/coverage-75.08%25-brightgreen)
+![Coverage](assets/repo/badges/coverage.svg)
 
 [![Follow @SocketSecurity](https://img.shields.io/twitter/follow/SocketSecurity?style=social)](https://twitter.com/SocketSecurity)
 [![Follow @socket.dev on Bluesky](https://img.shields.io/badge/Follow-@socket.dev-1DA1F2?style=social&logo=bluesky)](https://bsky.app/profile/socket.dev)
diff --git a/package.json b/package.json
index af23e7c86..e692148cb 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "// lockstep": "",
     "lockstep": "node scripts/fleet/lockstep.mts",
     "lockstep:emit-schema": "node scripts/fleet/lockstep-emit-schema.mts",
+    "lockstep:emit-mirror-globs": "node scripts/fleet/lockstep-emit-mirror-globs.mts",
     "// Setup": "",
     "setup": "node scripts/repo/setup.mts",
     "postinstall": "node scripts/repo/setup.mts --install --quiet",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 2ae7f0ca9..407970386 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -35,7 +35,7 @@
     "build:sea": "node --max-old-space-size=8192 --import=./scripts/load.mts scripts/build-sea.mts",
     "build:js": "node scripts/build-js.mts",
     "dev:watch": "pnpm run build:watch",
-    "check": "node ../../scripts/check.mts",
+    "check": "node ../../scripts/fleet/check.mts",
     "check-ci": "pnpm run check",
     "lint": "oxlint -c ../../.config/oxlintrc.json",
     "lint-ci": "pnpm run lint",
@@ -71,7 +71,7 @@
     "test:validate": "node --import=./scripts/load.mts scripts/validate-tests.mts",
     "test-ci": "run-s test:prepare test:unit test:validate",
     "test-pre-commit": "cross-env PRE_COMMIT=1 pnpm test",
-    "update": "node ../../scripts/update.mts",
+    "update": "node ../../scripts/fleet/update.mts",
     "verify": "node scripts/verify-package.mts",
     "wasm": "node scripts/wasm.mts",
     "wasm:build": "node scripts/wasm.mts --build",
diff --git a/scripts/fleet/_shared/action-port-map.mts b/scripts/fleet/_shared/action-port-map.mts
index 2b0cdee58..830cc63d6 100644
--- a/scripts/fleet/_shared/action-port-map.mts
+++ b/scripts/fleet/_shared/action-port-map.mts
@@ -78,6 +78,13 @@ export const COMPOSITE_ACTION_PORTS: Readonly<
   'setup-git-signing': [
     { portedAt: 'v7.0.0', upstream: 'crazy-max/ghaction-import-gpg' },
   ],
+  // Socket-original inline Go-toolchain locator: its header states it is
+  // "written inline so we don't depend on a third-party action". It only takes
+  // inspiration from actions/setup-go's generic fallback ordering (PATH →
+  // hosted toolcache → distro package manager → bail); it ports neither that
+  // action's input surface nor its go.dev/dl download algorithm, so there is no
+  // upstream release to lock-step against.
+  'setup-go-toolchain': [],
 }
 
 // Split an `<owner>/<repo>` slug; undefined when the shape is wrong. Pure.