diff --git a/.citools/README.md b/.citools/README.md
new file mode 100644
index 00000000000..fad45076926
--- /dev/null
+++ b/.citools/README.md
@@ -0,0 +1,41 @@
+## API
+
+### Adding and Upgrading Tools
+
+To add a new tool, execute the installation script:
+
+```bash
+install.sh <tool>
+```
+
+#### Example
+
+The following command will add `lefthook` to the tracked tools if it is not already installed, or update its version:
+
+```bash
+install.sh github.com/evilmartians/lefthook@v1.11.10
+```
+
+Behind the scenes, the script performs a few simple steps:
+
+- Creates a Go module under the `.citools/src/<toolname>` directory to track the tool version and its dependencies.
+- Creates a reference to the tool binary in the `.citools/Variables.mk` file.
+
+### Using Tools in the Makefile
+
+Our Makefile imports `.citools/Variables.mk`, so you can call a tool binary using standard Make syntax.
+
+#### Example
+
+```make
+run:
+    $(bra) run
+```
+
+### Using Tracked Tools Without the Makefile
+
+If you want to use a tool outside of the Makefile, you can locate the tool binary by executing the following command:
+
+```bash
+GOWORK=off go tool -n -modfile=<path_to_modfile> <toolname>
+```
diff --git a/.citools/Variables.mk b/.citools/Variables.mk
new file mode 100644
index 00000000000..54f102dba73
--- /dev/null
+++ b/.citools/Variables.mk
@@ -0,0 +1,34 @@
+# Generated tool paths
+tools_dir := $(shell cd $(dir $(lastword $(MAKEFILE_LIST))) && pwd)
+src_dir := $(tools_dir)/src
+
+# Due to a race condition, after initial call to `go tool` golang may report a wrong binary location pointing to the invalid `/tmp/go-buildXXX` directory
+define compile_tool
+$(shell \
+  (cd $(src_dir)/$(1) \
+  && GOWORK=off go tool -n $(2) > /dev/null \
+  && GOWORK=off go tool -n $(2)) | sed 's/^[[:space:]]*//g'; \
+)
+endef
+
+
+# Tool: "bra"
+bra = "$(call compile_tool,bra,github.com/unknwon/bra)"
+
+# Tool: "cog"
+cog = "$(call compile_tool,cog,github.com/grafana/cog/cmd/cli)"
+
+# Tool: "cue"
+cue = "$(call compile_tool,cue,cuelang.org/go/cmd/cue)"
+
+# Tool: "golangci-lint"
+golangci-lint = "$(call compile_tool,golangci-lint,github.com/golangci/golangci-lint/v2/cmd/golangci-lint)"
+
+# Tool: "jb"
+jb = "$(call compile_tool,jb,github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb)"
+
+# Tool: "lefthook"
+lefthook = "$(call compile_tool,lefthook,github.com/evilmartians/lefthook)"
+
+# Tool: "swagger"
+swagger = "$(call compile_tool,swagger,github.com/go-swagger/go-swagger/cmd/swagger)"
diff --git a/.citools/generate.sh b/.citools/generate.sh
new file mode 100755
index 00000000000..7bbdd7e8067
--- /dev/null
+++ b/.citools/generate.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+
+TOOLS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+TOOLS_SRC_DIR="$TOOLS_DIR/src"
+TOOLS_MK="$TOOLS_DIR/Variables.mk"
+
+echo "# Generated tool paths" > "$TOOLS_MK"
+
+cat <<'EOL' >> "$TOOLS_MK"
+tools_dir := $(shell cd $(dir $(lastword $(MAKEFILE_LIST))) && pwd)
+src_dir := $(tools_dir)/src
+
+# Due to a race condition, after initial call to `go tool` golang may report a wrong binary location pointing to the invalid `/tmp/go-buildXXX` directory
+define compile_tool
+$(shell \
+  (cd $(src_dir)/$(1) \
+  && GOWORK=off go tool -n $(2) > /dev/null \
+  && GOWORK=off go tool -n $(2)) | sed 's/^[[:space:]]*//g'; \
+)
+endef
+
+EOL
+
+for tooldir in "$TOOLS_SRC_DIR"/*; do
+  [ -d "$tooldir" ] || continue
+  tool=$(basename "$tooldir")
+  fqtn=$(awk '/^tool / { print $2 }' "$tooldir/go.mod")
+
+  cat <<EOL >> "$TOOLS_MK"
+
+# Tool: "$tool"
+${tool} = "\$(call compile_tool,${tool},${fqtn})"
+EOL
+done
diff --git a/.citools/install.sh b/.citools/install.sh
new file mode 100755
index 00000000000..f56b87bca4b
--- /dev/null
+++ b/.citools/install.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+set -euo pipefail
+
+TOOLS_BASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TOOLS_SRC_DIR="$TOOLS_BASE_DIR/src"
+
+IMPORT_PATH_WITH_VERSION="$1"
+
+if [[ "$IMPORT_PATH_WITH_VERSION" != *"@"* ]]; then
+  echo "Error: tool version must be specified (e.g., github.com/foo/bar@v1.2.3)"
+  exit 1
+fi
+
+TOOL_PATH="${IMPORT_PATH_WITH_VERSION%@*}"
+TOOL_NAME="${TOOL_PATH##*/}"
+
+TOOL_DIR="$TOOLS_SRC_DIR/$TOOL_NAME"
+MOD_FILE="$TOOL_DIR/go.mod"
+
+mkdir -p "$TOOL_DIR"
+cd "$TOOL_DIR"
+
+  # Create a new module if go.mod doesn't exist
+if [ ! -f go.mod ]; then
+  go mod init "$TOOL_NAME"
+fi
+
+go get -tool --modfile="$MOD_FILE" "$IMPORT_PATH_WITH_VERSION"
+echo "Installed $TOOL_NAME"
+echo "  Directory: $TOOL_DIR"
+echo "  Modfile: $MOD_FILE"
+
+exec "$TOOLS_BASE_DIR/generate.sh"
diff --git a/.citools/bra/go.mod b/.citools/src/bra/go.mod
similarity index 100%
rename from .citools/bra/go.mod
rename to .citools/src/bra/go.mod
diff --git a/.citools/bra/go.sum b/.citools/src/bra/go.sum
similarity index 100%
rename from .citools/bra/go.sum
rename to .citools/src/bra/go.sum
diff --git a/.citools/cog/go.mod b/.citools/src/cog/go.mod
similarity index 100%
rename from .citools/cog/go.mod
rename to .citools/src/cog/go.mod
diff --git a/.citools/cog/go.sum b/.citools/src/cog/go.sum
similarity index 100%
rename from .citools/cog/go.sum
rename to .citools/src/cog/go.sum
diff --git a/.citools/cue/go.mod b/.citools/src/cue/go.mod
similarity index 100%
rename from .citools/cue/go.mod
rename to .citools/src/cue/go.mod
diff --git a/.citools/cue/go.sum b/.citools/src/cue/go.sum
similarity index 100%
rename from .citools/cue/go.sum
rename to .citools/src/cue/go.sum
diff --git a/.citools/golangci-lint/go.mod b/.citools/src/golangci-lint/go.mod
similarity index 100%
rename from .citools/golangci-lint/go.mod
rename to .citools/src/golangci-lint/go.mod
diff --git a/.citools/golangci-lint/go.sum b/.citools/src/golangci-lint/go.sum
similarity index 100%
rename from .citools/golangci-lint/go.sum
rename to .citools/src/golangci-lint/go.sum
diff --git a/.citools/jb/go.mod b/.citools/src/jb/go.mod
similarity index 100%
rename from .citools/jb/go.mod
rename to .citools/src/jb/go.mod
diff --git a/.citools/jb/go.sum b/.citools/src/jb/go.sum
similarity index 100%
rename from .citools/jb/go.sum
rename to .citools/src/jb/go.sum
diff --git a/.citools/lefthook/go.mod b/.citools/src/lefthook/go.mod
similarity index 100%
rename from .citools/lefthook/go.mod
rename to .citools/src/lefthook/go.mod
diff --git a/.citools/lefthook/go.sum b/.citools/src/lefthook/go.sum
similarity index 100%
rename from .citools/lefthook/go.sum
rename to .citools/src/lefthook/go.sum
diff --git a/.citools/swagger/go.mod b/.citools/src/swagger/go.mod
similarity index 100%
rename from .citools/swagger/go.mod
rename to .citools/src/swagger/go.mod
diff --git a/.citools/swagger/go.sum b/.citools/src/swagger/go.sum
similarity index 100%
rename from .citools/swagger/go.sum
rename to .citools/src/swagger/go.sum
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 1c899cb81f1..bd621ad0bc1 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -467,6 +467,7 @@
 /stylelint.config.js @grafana/frontend-ops
 /tools/ @grafana/frontend-ops
 /lefthook.yml @grafana/frontend-ops
+/lefthook.rc @grafana/frontend-ops
 /.husky/pre-commit @grafana/frontend-ops
 /cypress.config.js @grafana/grafana-frontend-platform
 /.levignore.js @grafana/plugins-platform-frontend
diff --git a/Dockerfile b/Dockerfile
index efa061be39f..d84028877d5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -60,13 +60,7 @@ WORKDIR /tmp/grafana
 
 COPY go.* ./
 COPY .bingo .bingo
-COPY .citools/bra .citools/bra
-COPY .citools/cue .citools/cue
-COPY .citools/cog .citools/cog
-COPY .citools/lefthook .citools/lefthook
-COPY .citools/jb .citools/jb
-COPY .citools/golangci-lint .citools/golangci-lint
-COPY .citools/swagger .citools/swagger
+COPY .citools .citools
 
 # Include vendored dependencies
 COPY pkg/util/xorm pkg/util/xorm
diff --git a/Makefile b/Makefile
index 1f4dcb47525..2239d18b510 100644
--- a/Makefile
+++ b/Makefile
@@ -6,6 +6,7 @@ WIRE_TAGS = "oss"
 
 -include local/Makefile
 include .bingo/Variables.mk
+include .citools/Variables.mk
 
 GO = go
 GO_VERSION = 1.24.3
@@ -60,13 +61,13 @@ $(NGALERT_SPEC_TARGET):
 
 $(MERGED_SPEC_TARGET): swagger-oss-gen swagger-enterprise-gen $(NGALERT_SPEC_TARGET)  ## Merge generated and ngalert API specs
 	# known conflicts DsPermissionType, AddApiKeyCommand, Json, Duration (identical models referenced by both specs)
-	GODEBUG=gotypesalias=0 $(GO) tool swagger mixin -q $(SPEC_TARGET) $(ENTERPRISE_SPEC_TARGET) $(NGALERT_SPEC_TARGET) --ignore-conflicts -o $(MERGED_SPEC_TARGET)
+	GODEBUG=gotypesalias=0 $(swagger) mixin -q $(SPEC_TARGET) $(ENTERPRISE_SPEC_TARGET) $(NGALERT_SPEC_TARGET) --ignore-conflicts -o $(MERGED_SPEC_TARGET)
 
 .PHONY: swagger-oss-gen
 swagger-oss-gen: ## Generate API Swagger specification
 	@echo "re-generating swagger for OSS"
 	rm -f $(SPEC_TARGET)
-	SWAGGER_GENERATE_EXTENSION=false GODEBUG=gotypesalias=0 $(GO) tool swagger generate spec -q -m -w pkg/server -o $(SPEC_TARGET) \
+	SWAGGER_GENERATE_EXTENSION=false GODEBUG=gotypesalias=0 $(swagger) generate spec -q -m -w pkg/server -o $(SPEC_TARGET) \
 	-x "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions" \
 	-x "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options" \
 	-x "github.com/prometheus/alertmanager" \
@@ -84,7 +85,7 @@ else
 swagger-enterprise-gen: ## Generate API Swagger specification
 	@echo "re-generating swagger for enterprise"
 	rm -f $(ENTERPRISE_SPEC_TARGET)
-	SWAGGER_GENERATE_EXTENSION=false GODEBUG=gotypesalias=0 $(GO) tool swagger generate spec -q -m -w pkg/server -o $(ENTERPRISE_SPEC_TARGET) \
+	SWAGGER_GENERATE_EXTENSION=false GODEBUG=gotypesalias=0 $(swagger) generate spec -q -m -w pkg/server -o $(ENTERPRISE_SPEC_TARGET) \
 	-x "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions" \
 	-x "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options" \
 	-x "github.com/prometheus/alertmanager" \
@@ -98,7 +99,7 @@ swagger-gen: gen-go $(MERGED_SPEC_TARGET) swagger-validate
 
 .PHONY: swagger-validate
 swagger-validate: $(MERGED_SPEC_TARGET) # Validate API spec
-	GODEBUG=gotypesalias=0 $(GO) tool swagger validate --skip-warnings $(<)
+	GODEBUG=gotypesalias=0 $(swagger) validate --skip-warnings $(<)
 
 .PHONY: swagger-clean
 swagger-clean:
@@ -110,11 +111,11 @@ cleanup-old-git-hooks:
 
 .PHONY: lefthook-install
 lefthook-install: cleanup-old-git-hooks # install lefthook for pre-commit hooks
-	$(GO) tool lefthook install -f
+	$(lefthook) install -f
 
 .PHONY: lefthook-uninstall
 lefthook-uninstall:
-	$(GO) tool lefthook uninstall
+	$(lefthook) uninstall
 
 ##@ OpenAPI 3
 OAPI_SPEC_TARGET = public/openapi3.json
@@ -194,8 +195,8 @@ gen-go:
 .PHONY: fix-cue
 fix-cue:
 	@echo "formatting cue files"
-	$(GO) tool cue fix kinds/**/*.cue
-	$(GO) tool cue fix public/app/plugins/**/**/*.cue
+	$(cue) fix kinds/**/*.cue
+	$(cue) fix public/app/plugins/**/**/*.cue
 
 .PHONY: gen-jsonnet
 gen-jsonnet:
@@ -252,7 +253,7 @@ build: build-go build-js ## Build backend and frontend.
 
 .PHONY: run
 run: ## Build and run web server on filesystem changes. See /.bra.toml for configuration.
-	$(GO) tool bra run
+	$(bra) run
 
 .PHONY: run-go
 run-go: ## Build and run web server immediately.
@@ -344,7 +345,7 @@ test: test-go test-js ## Run all tests.
 .PHONY: golangci-lint
 golangci-lint:
 	@echo "lint via golangci-lint"
-	$(GO) tool golangci-lint run \
+	$(golangci-lint) run \
 		--config .golangci.yml \
 		$(if $(GO_BUILD_TAGS),--build-tags $(GO_BUILD_TAGS)) \
 		$(GO_LINT_FILES)
@@ -359,7 +360,7 @@ lint-go-diff:
 		$(XARGSR) dirname | \
 		sort -u | \
 		sed 's,^,./,' | \
-		$(XARGSR) $(GO) tool golangci-lint run --config .golangci.yml
+		$(XARGSR) $(golangci-lint) run --config .golangci.yml
 
 # with disabled SC1071 we are ignored some TCL,Expect `/usr/bin/env expect` scripts
 .PHONY: shellcheck
diff --git a/go.work b/go.work
index 535f6cd6b86..1ce67f60e81 100644
--- a/go.work
+++ b/go.work
@@ -5,13 +5,6 @@ go 1.24.3
 
 use (
 	. // skip:golangci-lint
-	./.citools/bra
-	./.citools/cog
-	./.citools/cue
-	./.citools/golangci-lint
-	./.citools/jb
-	./.citools/lefthook
-	./.citools/swagger
 	./apps/advisor
 	./apps/alerting/notifications
 	./apps/dashboard
diff --git a/go.work.sum b/go.work.sum
index 2834c6ee2e5..c8df60244d9 100644
--- a/go.work.sum
+++ b/go.work.sum
@@ -630,6 +630,7 @@ github.com/alecthomas/kong v0.8.0 h1:ryDCzutfIqJPnNn0omnrgHLbAggDQM2VWHikE1xqK7s
 github.com/alecthomas/kong v0.8.0/go.mod h1:n1iCIO2xS46oE8ZfYCNDqdR0b0wZNrXAIAqro/2132U=
 github.com/alecthomas/participle/v2 v2.1.1 h1:hrjKESvSqGHzRb4yW1ciisFJ4p3MGYih6icjJvbsmV8=
 github.com/alecthomas/participle/v2 v2.1.1/go.mod h1:Y1+hAs8DHPmc3YUFzqllV+eSQ9ljPTk0ZkPMtEdAx2c=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
 github.com/alexflint/go-arg v1.4.2 h1:lDWZAXxpAnZUq4qwb86p/3rIJJ2Li81EoMbTMujhVa0=
 github.com/alexflint/go-arg v1.4.2/go.mod h1:9iRbDxne7LcR/GSvEr7ma++GLpdIU1zrghf2y2768kM=
 github.com/alexflint/go-arg v1.5.1 h1:nBuWUCpuRy0snAG+uIJ6N0UvYxpxA0/ghA/AaHxlT8Y=
@@ -742,6 +743,7 @@ github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7N
 github.com/bytedance/sonic v1.10.0-rc3 h1:uNSnscRapXTwUgTyOF0GVljYD08p9X/Lbr9MweSV3V0=
 github.com/bytedance/sonic v1.10.0-rc3/go.mod h1:iZcSUejdk5aukTND/Eu/ivjQuEL0Cu9/rf50Hi0u/g4=
 github.com/campoy/embedmd v1.0.0 h1:V4kI2qTJJLf4J29RzI/MAt2c3Bl4dQSYPuflzwFH2hY=
+github.com/campoy/embedmd v1.0.0/go.mod h1:oxyr9RCiSXg0M3VJ3ks0UGfp98BpSSGr0kpiX3MzVl8=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
 github.com/casbin/casbin/v2 v2.37.0/go.mod h1:vByNa/Fchek0KZUgG5wEsl7iFsiviAYKRtgrQfcJqHg=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
@@ -848,6 +850,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46t
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/creasty/defaults v1.8.0 h1:z27FJxCAa0JKt3utc0sCImAEb+spPucmKoOdLHvHYKk=
 github.com/creasty/defaults v1.8.0/go.mod h1:iGzKe6pbEHnpMPtfDXZEr0NVxWnPTjb1bbDy08fPzYM=
 github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo=
@@ -1043,6 +1047,8 @@ github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg78
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-viper/mapstructure/v2 v2.0.0-alpha.1 h1:TQcrn6Wq+sKGkpyPvppOz99zsMBaUOKXq6HSv655U1c=
 github.com/go-viper/mapstructure/v2 v2.0.0-alpha.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
+github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-zookeeper/zk v1.0.2/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
@@ -1102,6 +1108,8 @@ github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qA
 github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/googleapis/cloud-bigtable-clients-test v0.0.2 h1:S+sCHWAiAc+urcEnvg5JYJUOdlQEm/SEzQ/c/IdAH5M=
 github.com/googleapis/cloud-bigtable-clients-test v0.0.2/go.mod h1:mk3CrkrouRgtnhID6UZQDK3DrFFa7cYCAJcEmNsHYrY=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
@@ -1718,6 +1726,8 @@ github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 h1:QldyIu/L63oPpyvQmHgvgickp1Yw510KJOqX7H24mg8=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77 h1:ESFSdwYZvkeru3RtdrYueztKhOBCSAAzS4Gf+k0tEow=
 github.com/ydb-platform/ydb-go-genproto v0.0.0-20241112172322-ea1f63298f77 h1:LY6cI8cP4B9rrpTleZk95+08kl2gF4rixG7+V/dwL6Q=
 github.com/ydb-platform/ydb-go-genproto v0.0.0-20241112172322-ea1f63298f77/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
@@ -1906,6 +1916,8 @@ go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
@@ -1987,6 +1999,7 @@ golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbht
 golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
@@ -2157,6 +2170,7 @@ google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojt
 google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/airbrake/gobrake.v2 v2.0.9 h1:7z2uVWwn7oVeeugY1DtlPAy5H+KYgB1KeKTnqjNatLo=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.25 h1:Ev7yu1/f6+d+b3pi5vPdRPc6nNtP1umSfcWiEfRqv6I=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
diff --git a/lefthook.rc b/lefthook.rc
new file mode 100644
index 00000000000..b085b38bfe6
--- /dev/null
+++ b/lefthook.rc
@@ -0,0 +1,6 @@
+# This file is used by lefthook to 'expose' the installed lefthook under
+# the name `lefthook`, as expected by the lefthook pre-commit scripts
+
+lefthook () {
+  GOWORK=off go tool -n -modfile=.citools/src/lefthook/go.mod github.com/evilmartians/lefthook
+}
diff --git a/pkg/build/daggerbuild/backend/builder.go b/pkg/build/daggerbuild/backend/builder.go
index b981beb61ee..2ca8c6b6bf2 100644
--- a/pkg/build/daggerbuild/backend/builder.go
+++ b/pkg/build/daggerbuild/backend/builder.go
@@ -189,6 +189,7 @@ func Wire(d *dagger.Client, src *dagger.Directory, platform dagger.Platform, goV
 		WithDirectory("/src/pkg", src.Directory("pkg")).
 		WithDirectory("/src/apps", src.Directory("apps")).
 		WithDirectory("/src/.bingo", src.Directory(".bingo")).
+		WithDirectory("/src/.citools", src.Directory(".citools")).
 		WithFile("/src/Makefile", src.File("Makefile")).
 		WithWorkdir("/src").
 		WithExec([]string{"make", "gen-go", fmt.Sprintf("WIRE_TAGS=%s", wireTag)}).