diff --git a/.github/workflows/base-refresh.yaml b/.github/workflows/base-refresh.yaml
index caba3dd..95c3432 100644
--- a/.github/workflows/base-refresh.yaml
+++ b/.github/workflows/base-refresh.yaml
@@ -40,7 +40,9 @@ jobs:
           token: ${{ secrets.BOT_PAT }}
 
       - name: Resolve + rewrite drifted base pins
-        run: make update-base | tee /tmp/base-refresh.log
+        run: |
+          set -eo pipefail
+          make update-base | tee /tmp/base-refresh.log
 
       - name: Open / update PR on drift
         env:
diff --git a/.github/workflows/binaries.yaml b/.github/workflows/binaries.yaml
index 0779238..136b9e1 100644
--- a/.github/workflows/binaries.yaml
+++ b/.github/workflows/binaries.yaml
@@ -21,10 +21,11 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Cache the cross-compiled binaries between runs, keyed on every
-      # input that affects the build: the build script + the makefile
-      # (which holds the version pins CHISEL_REF / SPREAD_REF /
-      # DOCKER_VERSION / GO_BUILDER_IMAGE). Hit -> skip the make step.
-      # Miss -> make rebuilds and the cache auto-saves at job end.
+      # input that affects the build: the build script, the chisel patches,
+      # + the makefile (which holds the version pins CHISEL_REF / SPREAD_REF /
+      # DOCKER_VERSION / GO_BUILDER_IMAGE). Mirrors hack/hash_inputs.sh's
+      # binaries input set. Hit -> skip the make step. Miss -> make rebuilds
+      # and the cache auto-saves at job end.
       - name: Restore binaries cache
         id: binaries-cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -32,7 +33,7 @@ jobs:
           path: |
             cache/binaries/
             .stamp/binaries
-          key: binaries-${{ hashFiles('hack/build_binaries.sh', 'makefile') }}
+          key: binaries-${{ hashFiles('hack/build_binaries.sh', 'patches/chisel/*.patch', 'makefile') }}
 
       - name: Build go binaries (chisel + spread + docker static)
         if: steps.binaries-cache.outputs.cache-hit != 'true'
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ef38bee..bb0aee6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -36,3 +36,22 @@ jobs:
       matrix: >-
         [{"runner": "ubuntu-24.04", "arch": "s390x",   "qemu": true},
          {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}]
+
+  # Guard: inlined/*.yaml is generated from templates/ + scripts/ and also
+  # committed (repo-tree consumers grab it directly). Regenerate and fail on
+  # drift so a template or script edit can't land without its matching
+  # inlined refresh. Ubuntu runners ship ruby, so no extra setup.
+  check-inlined:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Assert committed inlined yamls match templates + scripts
+        run: |
+          make inlined-yaml-files
+          if ! git diff --exit-code inlined/; then
+            echo "::error::inlined/*.yaml is stale -- run 'make inlined-yaml-files' and commit the result"
+            exit 1
+          fi
diff --git a/demo/spread.yaml b/demo/spread.yaml
index 0034a2d..e610401 100644
--- a/demo/spread.yaml
+++ b/demo/spread.yaml
@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -69,7 +67,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-22.04.yaml b/inlined/bread-22.04.yaml
index c0b1fc9..bbb2308 100644
--- a/inlined/bread-22.04.yaml
+++ b/inlined/bread-22.04.yaml
@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-24.04.yaml b/inlined/bread-24.04.yaml
index f1d0033..81a2c69 100644
--- a/inlined/bread-24.04.yaml
+++ b/inlined/bread-24.04.yaml
@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-25.10.yaml b/inlined/bread-25.10.yaml
index 5d7c8f7..fdf60ec 100644
--- a/inlined/bread-25.10.yaml
+++ b/inlined/bread-25.10.yaml
@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-26.04.yaml b/inlined/bread-26.04.yaml
index a5f803d..4a71f83 100644
--- a/inlined/bread-26.04.yaml
+++ b/inlined/bread-26.04.yaml
@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-26.10.yaml b/inlined/bread-26.10.yaml
index cbccffd..5d74d30 100644
--- a/inlined/bread-26.10.yaml
+++ b/inlined/bread-26.10.yaml
@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-chisel-releases-22.04.yaml b/inlined/bread-chisel-releases-22.04.yaml
index f538906..1f9610f 100644
--- a/inlined/bread-chisel-releases-22.04.yaml
+++ b/inlined/bread-chisel-releases-22.04.yaml
@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-chisel-releases-24.04.yaml b/inlined/bread-chisel-releases-24.04.yaml
index 8b4e803..84f217f 100644
--- a/inlined/bread-chisel-releases-24.04.yaml
+++ b/inlined/bread-chisel-releases-24.04.yaml
@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-chisel-releases-25.10.yaml b/inlined/bread-chisel-releases-25.10.yaml
index bc09f25..3c6916e 100644
--- a/inlined/bread-chisel-releases-25.10.yaml
+++ b/inlined/bread-chisel-releases-25.10.yaml
@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-chisel-releases-26.04.yaml b/inlined/bread-chisel-releases-26.04.yaml
index bd8c7f4..01227d7 100644
--- a/inlined/bread-chisel-releases-26.04.yaml
+++ b/inlined/bread-chisel-releases-26.04.yaml
@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/inlined/bread-chisel-releases-26.10.yaml b/inlined/bread-chisel-releases-26.10.yaml
index 04e691d..3ce2cdb 100644
--- a/inlined/bread-chisel-releases-26.10.yaml
+++ b/inlined/bread-chisel-releases-26.10.yaml
@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \
diff --git a/scripts/spread_allocate_bread-chisel-releases.sh b/scripts/spread_allocate_bread-chisel-releases.sh
index a582ea4..1a95d2a 100755
--- a/scripts/spread_allocate_bread-chisel-releases.sh
+++ b/scripts/spread_allocate_bread-chisel-releases.sh
@@ -1,5 +1,3 @@
-#spellchecker: ignore noninteractice
-
 set -e
 
 ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -55,7 +53,7 @@ docker run \
     --platform "linux/$arch" \
     --privileged \
     -v /var/run/docker.sock:/var/run/docker.sock \
-    -e DEBIAN_FRONTEND=noninteractice \
+    -e DEBIAN_FRONTEND=noninteractive \
     -e "usr=$SPREAD_SYSTEM_USERNAME" \
     -e "pass=$SPREAD_SYSTEM_PASSWORD" \
     $publish_flag \
diff --git a/scripts/spread_allocate_bread.sh b/scripts/spread_allocate_bread.sh
index 01a037c..7318ed6 100755
--- a/scripts/spread_allocate_bread.sh
+++ b/scripts/spread_allocate_bread.sh
@@ -1,5 +1,3 @@
-#spellchecker: ignore noninteractice
-
 set -e
 
 ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -56,7 +54,7 @@ echo "container_name: $container_name"
 docker run \
     --rm \
     --platform "linux/$arch" \
-    -e DEBIAN_FRONTEND=noninteractice \
+    -e DEBIAN_FRONTEND=noninteractive \
     -e "usr=$SPREAD_SYSTEM_USERNAME" \
     -e "pass=$SPREAD_SYSTEM_PASSWORD" \
     $publish_flag \
diff --git a/tests/spread.yaml b/tests/spread.yaml
index 587b189..a798942 100644
--- a/tests/spread.yaml
+++ b/tests/spread.yaml
@@ -17,8 +17,6 @@ backends:
     type: adhoc
 
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # ubuntu-26.04-amd64 -> 26.04
@@ -54,7 +52,7 @@ backends:
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
           -v "$repo_root:/spread-bread:ro" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           --name "$container_name" \