diff --git a/.github/workflows/ci-fresh-install.yml b/.github/workflows/ci-fresh-install.yml
index d5cf6ca5..d65023b4 100644
--- a/.github/workflows/ci-fresh-install.yml
+++ b/.github/workflows/ci-fresh-install.yml
@@ -42,6 +42,10 @@ jobs:
 
       - name: Install mcpp and config mirror
         run: |
+          # The release tarball bundles a pkgindex snapshot frozen at
+          # build time; refresh it so the workspace pin in .xlings.json
+          # (latest mcpp) resolves.
+          xlings update
           xlings install mcpp -y -g  # install to global
           mcpp --version
           mcpp self config --mirror GLOBAL
@@ -57,6 +61,15 @@ jobs:
           cd hello_gcc
           mcpp run
 
+      # Template packages exercise the sha256-pinned mcpp-index fetch
+      # path (user report: `mcpp new ... --template imgui` failed with
+      # fetch 'imgui@0.0.6' exit 1 on hosts without a sha256sum binary).
+      - name: "Template: mcpp new --template imgui (fetch path)"
+        run: |
+          cd "$(mktemp -d)"
+          mcpp new abc1 --template imgui
+          test -f abc1/mcpp.toml
+
       - name: "Default: build mcpp"
         run: |
           mcpp clean
@@ -112,7 +125,11 @@ jobs:
   # ──────────────────────────────────────────────────────────────────
   macos-fresh:
     name: macOS fresh install
-    runs-on: macos-15
+    # macos-14: the support floor (mcpp ≥0.0.50 / xlings ≥0.4.50 ship
+    # minos=14.0 static-libc++ binaries). A fresh install passing here
+    # is the continuous proof of the macOS 14 floor — and of host-tool
+    # independence (this image has no sha256sum; macos-15 does).
+    runs-on: macos-14
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
@@ -121,11 +138,18 @@ jobs:
         env:
           XLINGS_NON_INTERACTIVE: '1'
         run: |
-          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v0.4.38
+          # v0.4.50+: first xlings release whose macosx binary runs on
+          # macOS 14 (older ones carry minos=15 and refuse to start).
+          # v0.4.51: in-process sha256 — required on this image, which
+          # has no sha256sum binary (pinned fetches failed before).
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh | bash -s v0.4.51
           echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
 
       - name: Install mcpp and config mirror
         run: |
+          # Refresh the bundled pkgindex snapshot so the workspace pin
+          # in .xlings.json (latest mcpp) resolves.
+          xlings update
           xlings install mcpp -y -g  # install to global
           mcpp --version
           mcpp self config --mirror GLOBAL
@@ -141,6 +165,16 @@ jobs:
           cd hello_mac
           mcpp run
 
+      # Template packages exercise the sha256-pinned mcpp-index fetch
+      # path — this is what broke on hosts without a sha256sum binary
+      # (stock macOS / bare Windows) before xlings 0.4.51 hashed
+      # in-process.
+      - name: "Template: mcpp new --template imgui (fetch path)"
+        run: |
+          cd "$(mktemp -d)"
+          mcpp new abc1 --template imgui
+          test -f abc1/mcpp.toml
+
       - name: "LLVM: build mcpp"
         run: |
           mcpp clean
@@ -170,6 +204,9 @@ jobs:
       - name: Install mcpp and config mirror
         shell: pwsh
         run: |
+          # Refresh the bundled pkgindex snapshot so the workspace pin
+          # in .xlings.json (latest mcpp) resolves.
+          xlings update
           xlings install mcpp -y -g --verbose
 
           cat "$env:USERPROFILE\.xlings\.xlings.json"
@@ -185,6 +222,18 @@ jobs:
           Set-Location hello_win
           mcpp run
 
+      # Template packages exercise the sha256-pinned mcpp-index fetch
+      # path (user report: `mcpp new abc1 --template imgui` failed with
+      # fetch 'imgui@0.0.6' exit 1 on bare Windows — no sha256sum binary
+      # outside git-bash; fixed by xlings 0.4.51 in-process hashing).
+      - name: "Template: mcpp new --template imgui (fetch path)"
+        shell: pwsh
+        run: |
+          $tmp = New-TemporaryFile | ForEach-Object { Remove-Item $_; New-Item -ItemType Directory -Path $_ }
+          Set-Location $tmp
+          mcpp new abc1 --template imgui
+          if (!(Test-Path abc1/mcpp.toml)) { exit 1 }
+
       - name: "LLVM: build mcpp"
         shell: pwsh
         run: |
diff --git a/.xlings.json b/.xlings.json
index 940017aa..0d32bea3 100644
--- a/.xlings.json
+++ b/.xlings.json
@@ -1,5 +1,5 @@
 {
   "workspace": {
-    "mcpp": "0.0.20"
+    "mcpp": "0.0.52"
   }
 }