The config already used the new bare-string mount schema, which
v2026-07-01 rejects, so the pin moves with it.

Assisted-by: Claude Opus 5 via Claude Code

diff --git a/.config/ramekin/config.kdl b/.config/ramekin/config.kdl
index 628fe1c0..e6d5b772 100644
--- a/.config/ramekin/config.kdl
+++ b/.config/ramekin/config.kdl
@@ -27,6 +27,12 @@ mounts {
   // so the container needs the path the setting names.
   "~/.dotfiles/ai/skills"
 
+  // Pi packages, mounted since they can't be copied into the container.
+  "~/.pi/agent/git"
+
+  // Shadow the workspace's .envrc so repo secrets never reach the agent.
+  "/dev/null" target=".envrc"
+
   // Devlog entries are written from inside the container by the devlog skill,
   // so this rides in writable and persists across sessions.
   "~/.claude/devlog" writable=#true
diff --git a/bin/ramekin b/bin/ramekin
index 887ea034..c90f1ab5 100755
--- a/bin/ramekin
+++ b/bin/ramekin
@@ -4,18 +4,18 @@
   "name": "ramekin",
   "platforms": {
     "macos-aarch64": {
-      "size": 1247344,
+      "size": 1283228,
       "hash": "blake3",
-      "digest": "2b7cade5c107f6b864fb556a6923457b8508b8cabcb4006c46b20fb9b014b998",
+      "digest": "cbcdf5d4022e391a13003c19c216e5228f71e44dfb06999856105b4290a845ac",
       "path": "ramekin",
       "providers": [
         {
-          "url": "https://github.com/kejadlen/ramekin/releases/download/v2026-07-01+564c15b/ramekin-aarch64-apple-darwin.tar.gz"
+          "url": "https://github.com/kejadlen/ramekin/releases/download/v2026-08-07+72cda8e/ramekin-aarch64-apple-darwin.tar.gz"
         },
         {
           "type": "github-release",
           "repo": "https://github.com/kejadlen/ramekin",
-          "tag": "v2026-07-01+564c15b",
+          "tag": "v2026-08-07+72cda8e",
           "name": "ramekin-aarch64-apple-darwin.tar.gz"
         }
       ],