diff --git a/charts/deployment-operator/crds/deployments.plural.sh_agentruntimes.yaml b/charts/deployment-operator/crds/deployments.plural.sh_agentruntimes.yaml
index 68a9c1d32..d1a4398fe 100644
--- a/charts/deployment-operator/crds/deployments.plural.sh_agentruntimes.yaml
+++ b/charts/deployment-operator/crds/deployments.plural.sh_agentruntimes.yaml
@@ -2296,11 +2296,31 @@ spec:
                   or unset, codebase-memory indexes stay in the pod-local cache and generated
                   .codebase-memory/ artifacts are excluded from commits.
                 type: boolean
+              mise:
+                description: |-
+                  Mise supplies a mise.toml applied before the coding agent starts.
+                  When the default container root is writable, the harness runs
+                  `mise trust` and `mise bootstrap --yes`. When readOnlyRootFilesystem is true,
+                  the config is still mounted so mise exec can use [tools] and [env],
+                  but bootstrap is skipped.
+                properties:
+                  config:
+                    description: Config is the contents of a mise.toml.
+                    type: string
+                type: object
               name:
                 description: |-
                   Name of this AgentRuntime.
                   If not provided, the name from AgentRuntime.ObjectMeta will be used.
                 type: string
+              readOnlyRootFilesystem:
+                description: |-
+                  ReadOnlyRootFilesystem controls the default container securityContext.
+                  When unset, the root filesystem stays writable (the current default).
+                  Set true when extending a finished image that already contains compilers.
+                  Set false (or leave unset) together with mise.config to run
+                  `mise bootstrap --yes` at boot: https://mise.jdx.dev/bootstrap.html
+                type: boolean
               repositoryImage:
                 description: |-
                   RepositoryImage is an OCI image of precloned git repositories plus manifest.json.