diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json
new file mode 100644
index 000000000..736b0a42e
--- /dev/null
+++ b/.devcontainer/devcontainer-lock.json
@@ -0,0 +1,24 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:4": {
+      "version": "4.1.0",
+      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7",
+      "integrity": "sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7"
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {
+      "version": "1.1.2",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805",
+      "integrity": "sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805"
+    },
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "2.1.0",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857",
+      "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857"
+    },
+    "ghcr.io/devcontainers/features/python:1": {
+      "version": "1.8.0",
+      "resolved": "ghcr.io/devcontainers/features/python@sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511",
+      "integrity": "sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511"
+    }
+  }
+}
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 5ebdf0383..82a0cdedd 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,4 +1,17 @@
 {
   "name": "Ona",
-  "image": "mcr.microsoft.com/devcontainers/universal:4.0.1-noble"
+  // devcontainers/universal publishes a linux/amd64 manifest only, so it cannot
+  // run natively on arm64 hosts. base:noble keeps the Ubuntu Noble userland the
+  // Ona automations expect and supplies the toolchains through features.
+  "image": "mcr.microsoft.com/devcontainers/base:noble",
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:4": { "moby": false },
+    "ghcr.io/devcontainers/features/github-cli:1": {},
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "22",
+      "pnpmVersion": "none"
+    },
+    "ghcr.io/devcontainers/features/python:1": { "version": "3.12" }
+  },
+  "onCreateCommand": "sh .devcontainer/install.sh"
 }
diff --git a/.devcontainer/install.sh b/.devcontainer/install.sh
new file mode 100644
index 000000000..f27386239
--- /dev/null
+++ b/.devcontainer/install.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+set -eu
+
+# Install the development dependencies for the Node.js and Python workflows.
+# Shared by .devcontainer/devcontainer.json and .ona/automations.yml so editors
+# and Ona environments install the same toolchain.
+
+cd "$(dirname "$0")/.."
+
+# Install the pnpm release pinned by packageManager in package.json. Node ships
+# a corepack shim for pnpm, so installing it with npm collides with that shim.
+COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export COREPACK_ENABLE_DOWNLOAD_PROMPT
+corepack install
+
+# Keep bun aligned with the version pinned in .github/workflows/node-ci.yml.
+npm install --global bun@1.3.14 --no-audit --no-fund
+
+if ! command -v rg >/dev/null 2>&1; then
+    # Refresh only the Ubuntu sources. Dev container features add APT sources of
+    # their own, and apt-get update exits 100 when any configured source fails
+    # validation, which would stop this script before ripgrep installs.
+    sudo apt-get update \
+        -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources \
+        -o Dir::Etc::sourceparts=-
+    sudo apt-get install --yes ripgrep
+fi
+
+pnpm --dir sdk/typescript install --frozen-lockfile
+pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+python -m pip install --disable-pip-version-check --no-input -e 'plugins/codex-security[test]'
diff --git a/.gitignore b/.gitignore
index d6b8b94b5..0b4df76dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,7 @@ __pycache__/
 /codex-security.json
 /findings.json
 /*.sarif
+.pnpm-store/
 
 # Never publish internal-only plugin data.
 .internal/
diff --git a/.ona/automations.yml b/.ona/automations.yml
index 1024108ae..1599817a8 100644
--- a/.ona/automations.yml
+++ b/.ona/automations.yml
@@ -1,18 +1,7 @@
 tasks:
   install:
     name: Install dependencies
-    command: |
-      pnpm_package="$(node -p 'require("./package.json").packageManager.split("+")[0]')"
-      npm install --global "$pnpm_package" bun@1.3.14 --no-audit --no-fund
-      if ! command -v rg >/dev/null 2>&1; then
-        sudo apt-get update \
-          -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources \
-          -o Dir::Etc::sourceparts=-
-        sudo apt-get install --yes ripgrep
-      fi
-      pnpm --dir sdk/typescript install --frozen-lockfile
-      pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
-      python -m pip install --disable-pip-version-check --no-input -e 'plugins/codex-security[test]'
+    command: sh .devcontainer/install.sh
     triggeredBy:
       - manual
       - prebuild