diff --git a/.github/actions/zipx-sbt-setup/action.yml b/.github/actions/zipx-sbt-setup/action.yml
index ec6854b..12c73ca 100644
--- a/.github/actions/zipx-sbt-setup/action.yml
+++ b/.github/actions/zipx-sbt-setup/action.yml
@@ -27,6 +27,10 @@ inputs:
     description: Fixed cache epoch; when non-empty skips git-tag resolve and keys the cache with this value
     required: "false"
     default: ""
+  coursier:
+    description: When true, install cs via coursier/setup-action so the job can launch zipx-cli
+    required: "false"
+    default: "false"
 runs:
   using: composite
   steps:
@@ -35,9 +39,14 @@ runs:
       with:
         distribution: temurin
         java-version: ${{ inputs.java-version }}
-    - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7
+    - uses: sbt/setup-sbt@c7d2d6258b4bd0d3ec5129e6b3453199d3c79729 # v1.5.8
       with:
         disk-cache: ${{ inputs.sbt-disk-cache }}
+    - name: Setup Coursier
+      if: inputs.coursier == 'true'
+      uses: coursier/setup-action@9b7939bf01fd1185ce2babe16135168361bf2c62 # v3.0.2
+      with:
+        apps: cs
     - name: Setup Node
       if: inputs.node-version != ''
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 22c1de3..903883e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,8 +25,25 @@ jobs:
         id: check
         run: |
           # Commits landed by merging/squashing a PR are associated with that PR via the API.
-          prs=$(gh api "repos/${{ github.repository }}/commits/${{ github.sha }}/pulls" \
-            --jq "[.[] | select(.merged_at != null and .base.ref == \"${{ github.ref_name }}\")] | length")
+          # The commit-to-PR index can lag after squash; retry rather than fail-open into a second Verify.
+          prs=0
+          for attempt in 1 2 3 4 5 6; do
+            if [ "$prs" -eq 0 ]; then
+              if [ "$attempt" -eq 2 ]; then
+                sleep 1
+              elif [ "$attempt" -eq 3 ]; then
+                sleep 2
+              elif [ "$attempt" -eq 4 ]; then
+                sleep 4
+              elif [ "$attempt" -eq 5 ]; then
+                sleep 8
+              elif [ "$attempt" -eq 6 ]; then
+                sleep 16
+              fi
+              prs=$(gh api "repos/${{ github.repository }}/commits/${{ github.sha }}/pulls" \
+                --jq "[.[] | select(.merged_at != null and .base.ref == \"${{ github.ref_name }}\")] | length")
+            fi
+          done
           if [ "$prs" -gt 0 ]; then
             echo "Merged PR push, skipping redundant Verify (already ran on the PR)"
             echo "run=false" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/zipx-version-updates.yml b/.github/workflows/zipx-version-updates.yml
index 7baf0b8..3f67af3 100644
--- a/.github/workflows/zipx-version-updates.yml
+++ b/.github/workflows/zipx-version-updates.yml
@@ -35,11 +35,17 @@ jobs:
           cache-key-suffix: version-updates
           node-version: ""
           sbt-disk-cache: "false"
-          local-cache: "false"
+          local-cache: "true"
+          coursier: "true"
       - name: Apply catalog updates
         run: |
-          sbt "zipxDepUpdate yes"
-          sbt "zipxActionUpdate yes"
+          set -euo pipefail
+          . project/zipx-ci.env
+          if [ -z "${ZIPX_CLI_VERSION:-}" ]; then
+            echo "zipx: ZIPX_CLI_VERSION is unset. A release writes it to project/zipx-ci.env; dogfood sets it from zipxVersionUpdatesPreSteps."
+            exit 1
+          fi
+          cs launch --ttl Inf "rocks.earlyeffect:zipx-cli_3:$ZIPX_CLI_VERSION" -- catalog update --yes --verify-load
           sbt "zipxPinUpdate yes"
           sbt zipxCatalogGenerate
 
@@ -61,7 +67,7 @@ jobs:
           git push -u origin HEAD
           gh label create clean --force --description "zipx: Verify runs cleanFull" || true
           cat > /tmp/zipx-pr-body.md <<EOF
-          Applied zipxDepUpdate, zipxActionUpdate, and zipxPinUpdate.
+          Applied zipx-cli catalog update and zipxPinUpdate.
 
           ## Repo-root workflow YAML is not in this PR
 
diff --git a/project/ZipxVersions.scala b/project/ZipxVersions.scala
index ae6571f..3db551f 100644
--- a/project/ZipxVersions.scala
+++ b/project/ZipxVersions.scala
@@ -9,7 +9,7 @@ import zipx.*
   * already pulls `specular-site`.
   */
 object MyVersions extends ZipxVersions:
-  val sbt: SbtVersion     = SbtVersion("2.0.6")
+  val sbt: SbtVersion     = SbtVersion("2.0.7")
   val scala: ScalaVersion = ScalaVersion("3.8.4")
 
   val zio     = Lib("dev.zio", "zio", "2.1.26")
diff --git a/project/build.properties b/project/build.properties
index fa39d56..4dae759 100644
--- a/project/build.properties
+++ b/project/build.properties
@@ -1,2 +1,2 @@
 # Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
-sbt.version=2.0.6
+sbt.version=2.0.7
diff --git a/project/plugins.sbt b/project/plugins.sbt
index 4f63bf4..a3e2093 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -1,5 +1,5 @@
 // Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
-addSbtPlugin("rocks.earlyeffect" % "sbt-zipx" % "0.7.2")
+addSbtPlugin("rocks.earlyeffect" % "sbt-zipx" % "0.8.1")
 addSbtPlugin("org.scala-js" % "sbt-scalajs" % "1.22.0")
 addSbtPlugin("org.scalameta" % "sbt-scalafmt" % "2.6.2")
 addSbtPlugin("rocks.earlyeffect" % "sbt-dynver-ci" % "0.2.2")
diff --git a/project/zipx-ci.env b/project/zipx-ci.env
index 01719ab..c88d253 100644
--- a/project/zipx-ci.env
+++ b/project/zipx-ci.env
@@ -1,3 +1,4 @@
 # Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
 ZIPX_JAVA_VERSION=25
 ZIPX_RUNNER_OS=ubuntu-latest
+ZIPX_CLI_VERSION=0.8.1