@@ -16,6 +16,12 @@
 	"minimumReleaseAge": "3 days",
 	"mode": "full",
 	"packageRules": [
+		{
+			"description": "Keep the working Tirith scanner pinned until workflow analysis is compatible.",
+			"matchManagers": ["nix"],
+			"matchDepNames": ["tirith-nixpkgs"],
+			"enabled": false
+		},
 		{
 			"description": "Keep schemars on the 0.x API until its schema generator is migrated deliberately.",
 			"matchPackageNames": ["schemars"],
 
@@ -26,7 +26,7 @@ jobs:
   # `pull_request_target`), so fork PRs only ever get a read-only token and
   # cannot leak secrets while we scan their code. The downstream jobs `needs`
   # this job, so they are skipped unless tirith passes. tirith is installed from
-  # the flake's pinned nixpkgs so CI matches the dev shell.
+  # the flake's pinned package so CI matches the dev shell.
   tirith-scan:
     name: tirith security scan
     runs-on: blacksmith-32vcpu-ubuntu-2404
@@ -44,7 +44,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-nix-cache
       - name: Install tirith
-        run: nix profile install --inputs-from . nixpkgs#tirith
+        run: nix profile install .#tirith
       # One pass produces the SARIF report and sets the gate exit code. tirith's
       # `--ci` exit code is: 0 = no findings, 1 = findings at/above --fail-on,
       # 2 = findings present but all below it. We capture it (rather than letting
 
@@ -4,6 +4,9 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     pnpm-nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    # Tirith 0.4 rejects existing shell and Nushell workflow bodies as incomplete.
+    # Keep the last working scanner independent of routine nixpkgs updates.
+    tirith-nixpkgs.url = "github:NixOS/nixpkgs/91cc1fdf6831e29b6c98768e721a72241f3d0797";
     bun2nix = {
       url = "github:nix-community/bun2nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -55,6 +58,7 @@
         ./nix/git-hooks.nix
         ./nix/packages.nix
         ./nix/pnpm.nix
+        ./nix/tirith.nix
         ./nix/static-package.nix
         ./nix/darwin-x64-package.nix
         ./nix/tests.nix
 
@@ -28,6 +28,7 @@ in
           (with pkgs; [
             nodejs
             config.packages.pnpm
+            config.packages.tirith
             bun
             inputs.bun2nix.packages.${system}.default
             nushell
 
@@ -0,0 +1,8 @@
+{ inputs, ... }:
+{
+  perSystem =
+    { system, ... }:
+    {
+      packages.tirith = inputs.tirith-nixpkgs.legacyPackages.${system}.tirith;
+    };
+}
@@ -13,6 +13,7 @@
 		"google",
 		"ibm",
 		"inclusionai",
+		"liquid",
 		"meituan",
 		"meta",
 		"microsoft",
@@ -103,6 +104,7 @@
 		"command-r-plus-08-2024",
 		"command-r7b-12-2024",
 		"command-r7b-arabic-02-2025",
+		"d1",
 		"deep-research-max-preview-04-2026",
 		"deep-research-preview-04-2026",
 		"deepseek-chat",
@@ -127,6 +129,7 @@
 		"devstral-medium-latest",
 		"devstral-small-2",
 		"devstral-small-2507",
+		"diffusiongemma-26b-a4b-it",
 		"fugu",
 		"fugu-ultra",
 		"gemini-2-0-flash",
@@ -261,6 +264,7 @@
 		"grok-imagine-image-2-0",
 		"grok-imagine-image-quality",
 		"grok-imagine-video-1-5",
+		"grok-imagine-video-1-5-lite",
 		"grok-voice-stt-1-0",
 		"grok-voice-tts-1-0",
 		"hy3",
@@ -370,6 +374,7 @@
 		"nemotron-voicechat",
 		"nex-n2-pro",
 		"north-mini-code-1-0",
+		"north-small-translate-1-0",
 		"nova-2-lite",
 		"nova-lite",
 		"nova-micro",
@@ -473,6 +478,10 @@
 		"step-3-5-flash-2603",
 		"step-3-7-flash",
 		"step-5-preview",
+		"tiny-aya-earth",
+		"tiny-aya-fire",
+		"tiny-aya-global",
+		"tiny-aya-water",
 		"toast-1",
 		"trinity-large-preview",
 		"trinity-large-thinking",
@@ -551,6 +560,7 @@
 		"grok-imagine-image-2-0",
 		"grok-imagine-image-quality",
 		"grok-imagine-video-1-5",
+		"grok-imagine-video-1-5-lite",
 		"grok-voice-stt-1-0",
 		"grok-voice-tts-1-0",
 		"image-01",