@@ -19,6 +19,14 @@ inputs:
     description: "where the CTK components will be installed to, relative to $PWD"
     required: false
     default: "./cuda_toolkit"
+  install-mode:
+    description: >
+      "replace" (default) empties cuda-path before installing.
+      "add" installs the components on top of the mini CTK that an earlier
+      fetch_ctk call installed at the same cuda-path, and leaves the
+      environment that call exported unchanged.
+    required: false
+    default: "replace"
   redist-base-url:
     description: >
       Base URL of a redistrib server (manifest and component archives).
@@ -43,6 +51,34 @@ runs:
       with:
         dependent_exes: "curl unzip tar sha256sum cygpath"
 
+    - name: Check install mode
+      shell: bash --noprofile --norc -xeuo pipefail {0}
+      run: |
+        case "${{ inputs.install-mode }}" in
+          replace)
+            ;;
+          add)
+            # The environment exports are skipped in this mode, so the target
+            # must be the CUDA_PATH an earlier fetch_ctk call exported.
+            if [[ -z "${CUDA_PATH:-}" ]]; then
+              echo "::error::install-mode 'add' requires CUDA_PATH from an earlier fetch_ctk call"
+              exit 1
+            fi
+            EXISTING_PATH="$CUDA_PATH"
+            if [[ "${{ inputs.host-platform }}" == win* ]]; then
+              EXISTING_PATH="$(cygpath -u "$EXISTING_PATH")"
+            fi
+            if [[ "$(realpath -e "${{ inputs.cuda-path }}")" != "$(realpath -e "$EXISTING_PATH")" ]]; then
+              echo "::error::install-mode 'add' requires cuda-path to be the existing CUDA_PATH ($CUDA_PATH)"
+              exit 1
+            fi
+            ;;
+          *)
+            echo "::error::install-mode must be 'replace' or 'add', got '${{ inputs.install-mode }}'"
+            exit 1
+            ;;
+        esac
+
     - name: Set up CTK cache variable
       shell: bash --noprofile --norc -xeuo pipefail {0}
       run: |
@@ -170,7 +206,9 @@ runs:
         # symlinks from a prerelease CTK at ./cuda_toolkit/include etc., causing
         # "cp: cannot overwrite non-directory" failures on the next restore).
         CUDA_PATH="${{ inputs.cuda-path }}"
-        rm -rf $CUDA_PATH
+        if [[ "${{ inputs.install-mode }}" == replace ]]; then
+          rm -rf $CUDA_PATH
+        fi
         mkdir -p $CUDA_PATH
         # Unfortunately we cannot use "rsync -av $CACHE_TMP_DIR/ $CUDA_PATH" because
         # not all runners have rsync pre-installed (or even installable, such as
@@ -194,7 +232,9 @@ runs:
         ls -l
         CACHE_TMP_DIR="./cache_tmp_dir"
         CUDA_PATH="${{ inputs.cuda-path }}"
-        rm -rf $CUDA_PATH
+        if [[ "${{ inputs.install-mode }}" == replace ]]; then
+          rm -rf $CUDA_PATH
+        fi
         mkdir -p $CUDA_PATH
         tar -xzvf $CTK_CACHE_FILENAME
         # Can't use rsync here, see above
@@ -203,6 +243,7 @@ runs:
         ls -l $CUDA_PATH
 
     - name: Set output environment variables
+      if: ${{ inputs.install-mode == 'replace' }}
       shell: bash --noprofile --norc -xeuo pipefail {0}
       run: |
         # mimics actual CTK installation
 
@@ -366,14 +366,17 @@ jobs:
           host-platform: ${{ inputs.host-platform }}
           cuda-version: ${{ matrix.CUDA_VER }}
 
-      - name: Set up latest cuda_sanitizer_api
+      - name: Set up cuda_sanitizer_api
         if: ${{ (env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true') && env.SETUP_SANITIZER == '1' }}
         uses: ./.github/actions/fetch_ctk
         continue-on-error: false
         with:
           host-platform: ${{ inputs.host-platform }}
-          cuda-version: ${{ env.LATEST_CUDA_VERSION }}
+          # The build CTK's sanitizer, not the matrix CTK's: older sanitizers
+          # crash on the cuda.core tests, and newer ones carry the fixes.
+          cuda-version: ${{ inputs.build-ctk-ver }}
           cuda-components: "cuda_sanitizer_api"
+          install-mode: add
 
       - name: Set up compute-sanitizer
         if: ${{ env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true' }}
 
@@ -57,7 +57,6 @@
     ".github/workflows/test-wheel-linux.yml": "linux",
     ".github/workflows/test-wheel-windows.yml": "windows",
     "ci/tools/configure_driver_mode.ps1": "windows",
-    "ci/tools/guess_latest.sh": "linux",
     "ci/tools/install_gpu_driver.ps1": "windows",
     "ci/tools/install_gpu_driver.sh": "linux",
     "ci/tools/setup-sanitizer": "linux",
 
@@ -119,7 +119,6 @@ elif [[ "${1}" == "test" ]]; then
   # We only test compute-sanitizer on python 3.12 arbitrarily; we don't need to use sanitizer on the entire matrix
   # Only local ctk installs have compute-sanitizer; there is no wheel for it
   if [[ "${PY_VER}" == "3.12" && "${CUDA_VER}" != "11.8.0" && "${LOCAL_CTK}" == 1 && "${HOST_PLATFORM}" == linux* ]]; then
-    echo "LATEST_CUDA_VERSION=$(bash ci/tools/guess_latest.sh $TEST_CUDA_MAJOR)" >> $GITHUB_ENV
     SETUP_SANITIZER=1
   else
     SETUP_SANITIZER=0
 
@@ -29,10 +29,11 @@
 
 # Known-good sha256 of the redistrib metadata JSON, keyed by CUDA version.
 # Per-archive verification is only trustworthy if the JSON that carries the
-# archive hashes is itself trusted, so we pin the metadata too. A version that
-# is absent here is not blocked -- failing closed would break CI on every new
-# CTK -- but `verify-metadata` emits a warning; add the version's hash below as
-# it enters the matrix to pin it. Regenerate with:
+# archive hashes is itself trusted, so we pin the metadata too. `verify-metadata`
+# fails on a public-server version that is absent here, so add a version's hash
+# below in the same change that adds it to ci/versions.yml or a LOCAL_CTK row of
+# ci/test-matrix.yml; tests/test_fetch_ctk_redistrib.py enforces this.
+# Regenerate with:
 #   curl -fsSL \
 #     https://developer.download.nvidia.com/compute/cuda/redist/redistrib_<ver>.json \
 #     | sha256sum
@@ -41,6 +42,7 @@
     "12.9.1": "8335301010b0023ee1ff61eb11e2600ca62002d76780de4089011ad77e0c7630",
     "13.0.2": "fce66717a81c510ffeb89ecc3e79849ab34af3b80139f750876d9033e31d71c2",
     "13.4.2": "015b97aa3977d4d0bade1631b226b6d4cbe48751cc841aad9193295df7f9047a",
+    "13.5.0": "401529e951b845788177f999c0756c520c4d0db1cd4cd05c0a295e331884b596",
 }
 
 
@@ -154,8 +156,8 @@ def verify_metadata_sha256(*, cuda_version: str, metadata_path: str, metadata_so
     manifest under the same version number, so it is never checked against
     them; it only gets a warning.
 
-    Returns a process exit code: 1 on a mismatch (fail closed), 0 when the hash
-    matches, the version is not pinned yet, or the source is custom (warn only).
+    Returns a process exit code: 1 on a mismatch or an unpinned public version
+    (fail closed), 0 when the hash matches or the source is custom (warn only).
     """
     actual = compute_file_sha256(metadata_path)
     if metadata_source == "custom":
@@ -168,11 +170,11 @@ def verify_metadata_sha256(*, cuda_version: str, metadata_path: str, metadata_so
     expected = KNOWN_REDISTRIB_SHA256.get(cuda_version)
     if expected is None:
         print(
-            f"WARNING: no pinned redistrib sha256 for CUDA {cuda_version!r}; got {actual}. "
+            f"ERROR: no pinned redistrib sha256 for CUDA {cuda_version!r}; got {actual}. "
             f"Add it to KNOWN_REDISTRIB_SHA256 in {Path(__file__).name} to pin it.",
             file=sys.stderr,
         )
-        return 0
+        return 1
     if actual != expected:
         print(
             f"ERROR: redistrib metadata sha256 mismatch for CUDA {cuda_version!r}: expected {expected}, got {actual}",
@@ -207,7 +209,6 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
     verify_parser.add_argument("--cuda-version", required=True)
     verify_parser.add_argument("--metadata-path", required=True)
     verify_parser.add_argument("--metadata-source", choices=("public", "custom"), default="public")
-
     return parser.parse_args(argv)
 
 
 
@@ -85,7 +85,6 @@ def test_test_infrastructure_platforms(self) -> None:
             ".github/workflows/test-wheel-linux.yml": {"linux"},
             ".github/workflows/test-wheel-windows.yml": {"windows"},
             "ci/tools/configure_driver_mode.ps1": {"windows"},
-            "ci/tools/guess_latest.sh": {"linux"},
             "ci/tools/install_gpu_driver.ps1": {"windows"},
             "ci/tools/install_gpu_driver.sh": {"linux"},
             "ci/tools/setup-sanitizer": {"linux"},
 
@@ -4,20 +4,26 @@
 from __future__ import annotations
 
 import json
+import re
 import sys
 from pathlib import Path
 
 import pytest
+import yaml
 
 sys.path.insert(0, str(Path(__file__).parent.parent))
 from fetch_ctk_redistrib import (
+    KNOWN_REDISTRIB_SHA256,
     compute_file_sha256,
     get_component_relative_path,
     get_component_sha256,
     main,
     verify_metadata_sha256,
 )
 
+CI_DIR = Path(__file__).resolve().parents[2]
+SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
+
 # Minimal redistrib-shaped metadata. "cccl" exercises the cuda_cccl -> cccl
 # alias; "no_sha" lacks the sha256 field.
 FAKE_METADATA = {
@@ -101,14 +107,37 @@ def test_verify_metadata_mismatch_fails_closed(tmp_path, monkeypatch):
     assert verify_metadata_sha256(cuda_version="1.2.3", metadata_path=str(f)) == 1
 
 
-@pytest.mark.agent_authored(model="claude-opus-4.8")
-def test_verify_metadata_unknown_version_warns(tmp_path, capsys):
+@pytest.mark.agent_authored(model="claude-opus-5.5")
+def test_verify_metadata_unknown_version_fails_closed(tmp_path, capsys):
     f = tmp_path / "redistrib.json"
     f.write_bytes(b"whatever")
-    # An unpinned version must not fail closed (it would break CI on every new
-    # CTK), but it must emit a warning.
-    assert verify_metadata_sha256(cuda_version="99.9.9", metadata_path=str(f)) == 0
-    assert "WARNING" in capsys.readouterr().err
+    assert verify_metadata_sha256(cuda_version="99.9.9", metadata_path=str(f)) == 1
+    assert "ERROR" in capsys.readouterr().err
+
+
+@pytest.mark.agent_authored(model="claude-opus-5.5")
+def test_known_redistrib_sha256_covers_ci_cuda_versions():
+    # Every CUDA version CI fetches from the public server must be pinned, so a
+    # version bump fails here instead of in the fetch_ctk step.
+    versions = yaml.safe_load((CI_DIR / "versions.yml").read_text(encoding="utf-8"))
+    matrix = yaml.safe_load((CI_DIR / "test-matrix.yml").read_text(encoding="utf-8"))
+    required = {str(entry["version"]) for entry in versions["cuda"].values()}
+    required |= {
+        str(row["CUDA_VER"])
+        for platform in ("linux", "windows")
+        for rows in matrix[platform].values()
+        for row in rows
+        if str(row.get("LOCAL_CTK")) == "1"
+    }
+    assert required
+    missing = sorted(required - KNOWN_REDISTRIB_SHA256.keys())
+    assert not missing, (
+        f"CUDA versions used by CI have no pinned redistrib manifest hash: {missing}. "
+        "Add them to KNOWN_REDISTRIB_SHA256 in ci/tools/fetch_ctk_redistrib.py; compute each hash with "
+        "`curl -fsSL https://developer.download.nvidia.com/compute/cuda/redist/redistrib_<ver>.json | sha256sum`."
+    )
+    for version, sha256 in KNOWN_REDISTRIB_SHA256.items():
+        assert SHA256_RE.fullmatch(sha256), f"invalid pinned sha256 for CUDA {version}"
 
 
 @pytest.mark.agent_authored(model="claude-opus-4.8")
 
@@ -3,9 +3,13 @@
 
 backport_branch: "12.9.x"  # keep in sync with target-branch in .github/dependabot.yml
 
-# This controls the version of the upstream CTK to install to build the wheels.
+# This controls the version of the upstream CTK to install to build the wheels,
+# and the compute-sanitizer version used in all sanitizer test runs.
 # It is not the version of cuda_bindings/cuda_python being released, which is
 # solely determined by git tags via setuptools_scm.
+# Each version here, and in every LOCAL_CTK: '1' row of ci/test-matrix.yml,
+# needs a pinned manifest hash in KNOWN_REDISTRIB_SHA256 in
+# ci/tools/fetch_ctk_redistrib.py; fetch_ctk fails without one.
 cuda:
   build:
     version: "13.5.0"