diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 20ac792..1a8a9a6 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -146,7 +146,7 @@
             "description": "Respect virtualenv's filelock compatibility bound",
             "matchFileNames": ["test/requirements-tools.txt"],
             "matchDepNames": ["filelock"],
-            "allowedVersions": "<4"
+            "allowedVersions": "<5"
         },
         {
             "matchDatasources": ["docker"],
diff --git a/.vscode/settings.json b/.vscode/settings.json
index a49f3e3..4345f3b 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -152,6 +152,7 @@
         "SERVERLIST",
         "setitimer",
         "setsid",
+        "sboms",
         "setuptools",
         "shellcheck",
         "SIGALRM",
diff --git a/docs/container-scan-review.md b/docs/container-scan-review.md
index 5507881..09b1e5e 100644
--- a/docs/container-scan-review.md
+++ b/docs/container-scan-review.md
@@ -8,13 +8,13 @@ Buccaneerr uses Docker CLI 29.8.2 and Compose 5.6.0 from digest-pinned official
 
 The tool manifest locks CSpell, Pyright, and Markdownlint CLI2. Alpine's npm installs these checkers during the image build and is removed in the same layer, keeping its bundled dependencies out of the completed image. Pre-commit runs Markdownlint through the same Buccaneerr helper used for Python checks, so it does not install a separate Node environment. Removing npm also eliminates the bundled brace-expansion and http-cache-semantics vulnerabilities, including CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, and CVE-2026-93748. Renovate maintains the checker lockfile using npm 11.
 
-Pre-commit 4.6.2 and virtualenv 21.7.13 now install into `/opt/precommit` from `test/requirements-tools.txt`. Every dependency has an exact version and SHA-256 hashes, enforced with pip's `--require-hashes` mode. The bootstrap pip is removed after installation, keeping its older bundled libraries out of the completed image. This isolated test environment replaces Alpine's virtualenv 21.3.3, including four advisories reported by Scout: [CVE-2026-102925](https://github.com/advisories/GHSA-p58f-9548-mpm2), [CVE-2026-102930](https://github.com/advisories/GHSA-94p9-xgh2-xp45), [CVE-2026-102937](https://github.com/advisories/GHSA-x78j-v8h9-3j2q), and [CVE-2026-102938](https://github.com/advisories/GHSA-9h9j-4vrj-gf7g). These packages remain outside the production Privateerr image.
+Pre-commit 4.6.2 and virtualenv 21.14.5 now install into `/opt/precommit` from `test/requirements-tools.txt`. Every dependency has an exact version and SHA-256 hashes, enforced with pip's `--require-hashes` mode. The bootstrap pip is removed after installation. The image also removes virtualenv's unused Python 3.9 seed wheels, retaining the exact upstream pip 26.2.1 and setuptools 84.0.0 wheels for the installed Python 3.14 and their SHA-256 verification. This isolated test environment replaces Alpine's virtualenv 21.3.3, including four advisories reported by Scout: [CVE-2026-102925](https://github.com/advisories/GHSA-p58f-9548-mpm2), [CVE-2026-102930](https://github.com/advisories/GHSA-94p9-xgh2-xp45), [CVE-2026-102937](https://github.com/advisories/GHSA-x78j-v8h9-3j2q), and [CVE-2026-102938](https://github.com/advisories/GHSA-9h9j-4vrj-gf7g). These packages remain outside the production Privateerr image.
 
 Current `edge` images contain Python 3.14.8-r0; Buccaneerr also contains PCRE2 10.49-r0. These fix the Python and PCRE2 findings listed below. Alpine 3.24 stable now supplies nghttp2 1.70.0-r0 on all three platforms, so both images remove the old edge-package override. Buccaneerr still installs setuptools 83.0.0 or newer from edge because stable supplies 82.0.1-r1. Keep that remaining narrow exception until stable supplies the fixed version.
 
 ## Remaining package-level alerts
 
-Privateerr `edge` has no findings in either scanner across all three platforms. Before the virtualenv update, Buccaneerr `edge` has two unique Trivy findings and nine unique Scout findings; the four virtualenv findings have published fixes and are addressed by this change. The rebuilt ARM64 image has two unique Trivy findings and five unique Scout findings, with all four virtualenv advisories removed. The remaining package-level reports require the following context. No scanner exclusion hides them.
+Privateerr `edge` has no findings in either scanner across all three platforms. Before the virtualenv update, Buccaneerr `edge` has two unique Trivy findings and nine unique Scout findings; the four virtualenv findings have published fixes and are addressed by this change. The rebuilt image has two unique Trivy findings and twenty-four unique Scout identifiers, with all four virtualenv advisories removed. Virtualenv 21.14.5 adds an upstream package SBOM describing every original seed wheel, so Scout now reports bundled dependencies that the earlier review did not enumerate. Twelve identifiers concern retained packages or their metadata; twelve additional identifiers describe removed Python 3.9 seed assets in that upstream build inventory. The inventory remains unchanged and the removed files are verified absent from the completed image. The remaining package-level reports require the following context. No scanner exclusion hides them.
 
 - **CVE-2026-93687:** [braces 3.0.3](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) has a stack-exhaustion issue in deeply nested patterns and no published patched version. Markdownlint CLI2 depends on it through micromatch. Keep the GitHub dependency alert visible and use repository-controlled file patterns for checks.
 - **GO-2026-5932:** The Go [advisory](https://pkg.go.dev/vuln/GO-2026-5932) concerns the unmaintained OpenPGP package. Compose's module metadata includes `golang.org/x/crypto`; the advisory does not apply to every package in that module.
@@ -22,6 +22,18 @@ Privateerr `edge` has no findings in either scanner across all three platforms.
 - **CVE-2026-39824:** The Go [advisory](https://pkg.go.dev/vuln/GO-2026-5024) affects a Windows string conversion in `golang.org/x/sys/windows`. Buccaneerr runs the Linux actionlint binary, whose module metadata still includes the older version.
 - **CVE-2026-84445:** The gRPC [advisory](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj) affects servers configured with `xds.NewGRPCServer()`. Scout reports gRPC 1.84.0 in the Docker client, but the current upstream advisory lists 1.84.0 as patched. Buccaneerr also starts no xDS server; review the separate Docker host independently.
 
+## Bundled installer findings
+
+Virtualenv needs its integrity-checked pip seed wheel to create fresh Python hook environments. The current published pip release, 26.2.1, still vendors the dependencies below. Installing their standalone fixed releases does not replace code inside that wheel. The [upstream vendoring policy](https://pip.pypa.io/en/latest/development/vendoring-policy/) does not support partially removing bundled libraries. Updating their vendored versions would require maintaining and validating a custom pip distribution, so this image preserves the upstream wheel. There is no published pip release containing these dependency fixes as of this review. These findings remain visible in Scout and require an upstream pip update. They affect the test-only Buccaneerr seed installer; production Privateerr contains neither virtualenv nor pip.
+
+| Bundled dependency | Reported advisory | Standalone fixed version |
+| --- | --- | --- |
+| msgpack 1.1.2 | [CVE-2026-57585](https://github.com/advisories/GHSA-6v7p-g79w-8964) | 1.2.1 |
+| urllib3 2.7.0 | [CVE-2026-97687](https://www.cve.org/CVERecord?id=CVE-2026-97687), [CVE-2026-97688](https://www.cve.org/CVERecord?id=CVE-2026-97688), [CVE-2026-97689](https://www.cve.org/CVERecord?id=CVE-2026-97689) | 2.8.0 |
+| setuptools 70.3.0, limited to pip's vendored `pkg_resources` | [CVE-2025-47273](https://www.cve.org/CVERecord?id=CVE-2025-47273), [CVE-2026-59890](https://www.cve.org/CVERecord?id=CVE-2026-59890) | 78.1.1 and 83.0.0, respectively |
+
+The unused pip 26.0.1 and setuptools 82.0.1 seed wheels target Python 3.9, which this image does not provide. Removing those assets removes their vulnerable code without changing the active Python 3.14 seed wheels. Scout still reports the removed assets from virtualenv's original package SBOM at `virtualenv-21.14.5.dist-info/sboms/virtualenv.cdx.json`; that upstream inventory describes the unmodified distributed wheel, not the image after pruning. Keep this distinction visible when reviewing the scan. A fresh pre-commit Python hook environment verifies that environment creation and package installation still work.
+
 A successful workflow scan rejects fixed high or critical findings; it does not mean either scanner reports zero findings. CI uses `ignore-unfixed: true` and scans its local build. Use the full artifact scans above when evaluating other severities, unfixed dependencies, platforms, and published stable images.
 
 ## Stable image refresh
diff --git a/test/Dockerfile b/test/Dockerfile
index a7c357b..86e9778 100644
--- a/test/Dockerfile
+++ b/test/Dockerfile
@@ -99,11 +99,13 @@ RUN apk upgrade --no-cache libcrypto3 libssl3 && \
 
 # Install pre-commit with fixed virtualenv outside Alpine's older Python tool packages.
 # The complete lockfile verifies every dependency and keeps these tools test-only.
+# Keep only seed wheels for the installed Python, preserving their upstream hash checks.
 COPY test/requirements-tools.txt /tmp/requirements-tools.txt
 RUN python3 -m venv /opt/precommit && \
     /opt/precommit/bin/python -m pip install --no-cache-dir --disable-pip-version-check \
         --require-hashes --requirement /tmp/requirements-tools.txt && \
     /opt/precommit/bin/python -m pip uninstall --yes pip && \
+    /opt/precommit/bin/python -c 'import sys; from virtualenv.seed.wheels import embed; version = ".".join(map(str, sys.version_info[:2])); active = embed.BUNDLE_SUPPORT[version]; [embed.get_embed_wheel(package, version) for package in active]; [wheel.unlink() for wheel in embed.BUNDLE_FOLDER.glob("*.whl") if wheel.name not in active.values()]' && \
     apk del py3-pip && \
     rm /tmp/requirements-tools.txt
 ENV PATH="/opt/precommit/bin:${PATH}"
diff --git a/test/requirements-tools.txt b/test/requirements-tools.txt
index 3179b4f..f285c1c 100644
--- a/test/requirements-tools.txt
+++ b/test/requirements-tools.txt
@@ -14,9 +14,9 @@ distlib==0.4.3 \
     --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b \
     --hash=sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed
 
-filelock==3.32.7 \
-    --hash=sha256:37b8a3d9811b0f9aef7e5ec5c71bb320de52df51e6ca9bcd6f5ad81187660da7 \
-    --hash=sha256:65ff0d0190ea42038b32bda4b77834fb05be2cad4c5b9b01aa4dfb3614536e52
+filelock==4.0.10 \
+    --hash=sha256:00d6a81f976a6332551c2c10f39e12b4abb7e01c64d4c497b81a615bc9186f1f \
+    --hash=sha256:698048d158dc3c9e18cc5e88b3efdd4bd0e77d76686b22adb4511cc4b2c2f0db
 
 identify==2.6.20 \
     --hash=sha256:6a16b69b93187244e0548cbfd25b3e4a6f9a7a2ad784625c3bec2b8d27b81aaa \
@@ -26,6 +26,10 @@ nodeenv==1.11.0 \
     --hash=sha256:3ce8fe5b71d16e8af7039ca65257354100bc772965d6bc549070649e53b1b146 \
     --hash=sha256:edaa16e6c14d7cf395d75d4bbd5a26390f4dc06501a33b4e76282b02cc688a25
 
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
+
 platformdirs==4.12.3 \
     --hash=sha256:080f3b39423b5abfca9a23d84c4e9795f54d395cd8459867a8ded44084fcd5f8 \
     --hash=sha256:427fc0bb321ae0c5b037fa03238ca74820437be162e78b4848c4d4055b9b766c
@@ -113,6 +117,6 @@ pyyaml==6.0.3 \
     --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
     --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
 
-virtualenv==21.7.13 \
-    --hash=sha256:0355558b6f33619aab31347e43643b0ebc97f61ea3acf617b2b69e1f8a843d11 \
-    --hash=sha256:1bea5af7463f59c4719db48fe739579a2a4f569c96f26c086edda85c96da9f59
+virtualenv==21.14.5 \
+    --hash=sha256:b0651e0174982bba17cc6f0aaa2ef496730cb85a3f35eb5d1119d1c904f7d1da \
+    --hash=sha256:c4cb6c13e46b57225a999c7e22a09b163393878facc7ac4c059a57f46faa1647