diff --git a/README.md b/README.md
index 95c5974..85f8428 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@
 ![plugin: lua](https://img.shields.io/badge/plugin-lua-000080?style=flat&logo=lua&logoColor=white)
 [![runtime: mise](https://img.shields.io/badge/runtime-mise-7c3aed?style=flat)](https://mise.jdx.dev)
 ![tests: 82 passing](https://img.shields.io/badge/tests-82%20passing-brightgreen?style=flat)
-[![shiv: v0.3.2](https://img.shields.io/badge/shiv-v0.3.2-blue?style=flat)](https://github.com/KnickKnackLabs/shiv)
+[![shiv: v0.3.6](https://img.shields.io/badge/shiv-v0.3.6-blue?style=flat)](https://github.com/KnickKnackLabs/shiv)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue?style=flat)](LICENSE)
 
 </div>
@@ -37,7 +37,7 @@ mise install "shiv:shimmer@0.0.1-alpha"
   │    list git tags + branch pseudo-version → ["main", "0.0.1-alpha"]
   │
   ├─ BackendInstall
-  │    ensure shiv is bootstrapped (pinned to v0.3.2)
+  │    ensure shiv is bootstrapped (pinned to v0.3.6)
   │    SHIV_PACKAGES_DIR=<install_path>/packages \
   │    SHIV_BIN_DIR=<install_path>/bin \
   │      mise -C <shiv> run install shimmer@v0.0.1-alpha
@@ -46,7 +46,7 @@ mise install "shiv:shimmer@0.0.1-alpha"
        PATH += <install_path>/bin
 ```
 
-The plugin maintains its own shiv clone at `~/.local/share/mise/shiv-backend/shiv/`, pinned to `v0.3.2` for reproducibility. This is separate from any user-installed shiv — the plugin's build infrastructure doesn't change unless you deliberately update it.
+The plugin maintains its own shiv clone at `~/.local/share/mise/shiv-backend/shiv/`, pinned to `v0.3.6` for reproducibility. This is separate from any user-installed shiv — the plugin's build infrastructure doesn't change unless you deliberately update it.
 
 Version isolation comes from overriding shiv's path environment variables. Each version gets its own directory under mise's installs, so project A can pin `shimmer@0.0.1-alpha` while project B tracks the newest release with `latest`.
 
@@ -80,7 +80,7 @@ VFOX_SHIV_PATH     Path to plugin's shiv clone
                    Default: ~/.local/share/mise/shiv-backend/shiv
 
 VFOX_SHIV_REF      Pinned shiv version for bootstrap
-                   Default: v0.3.2
+                   Default: v0.3.6
 
 VFOX_SHIV_REPO     Shiv repository URL
                    Default: https://github.com/KnickKnackLabs/shiv.git
diff --git a/hooks/backend_install.lua b/hooks/backend_install.lua
index 86252cb..07e68df 100644
--- a/hooks/backend_install.lua
+++ b/hooks/backend_install.lua
@@ -362,7 +362,7 @@ function ensure_shiv()
     local shiv_path = get_shiv_path()
 
     -- Pin to a specific shiv version for reproducibility
-    local shiv_ref = os.getenv("VFOX_SHIV_REF") or "v0.3.2"
+    local shiv_ref = os.getenv("VFOX_SHIV_REF") or "v0.3.6"
     local shiv_repo = os.getenv("VFOX_SHIV_REPO") or "https://github.com/KnickKnackLabs/shiv.git"
 
     if shiv_bootstrap_ready(shiv_path, shiv_ref) then
diff --git a/test/bootstrap.bats b/test/bootstrap.bats
index 5685330..41c6846 100644
--- a/test/bootstrap.bats
+++ b/test/bootstrap.bats
@@ -13,7 +13,7 @@ setup() {
 
 @test "bootstrapped shiv is pinned to expected ref" {
   local shiv_path="${VFOX_SHIV_PATH:-$HOME/.local/share/mise/shiv-backend/shiv}"
-  local expected_ref="${VFOX_SHIV_REF:-v0.3.2}"
+  local expected_ref="${VFOX_SHIV_REF:-v0.3.6}"
 
   run git -C "$shiv_path" describe --tags --exact-match HEAD
   [ "$status" -eq 0 ]
diff --git a/test/helpers.bash b/test/helpers.bash
index e7570e2..fe2ecb4 100644
--- a/test/helpers.bash
+++ b/test/helpers.bash
@@ -39,7 +39,7 @@ EOF
 # Triggers bootstrap by installing a lightweight package.
 ensure_bootstrap() {
   local shiv_path="${VFOX_SHIV_PATH:-$HOME/.local/share/mise/shiv-backend/shiv}"
-  local expected_ref="${VFOX_SHIV_REF:-v0.3.2}"
+  local expected_ref="${VFOX_SHIV_REF:-v0.3.6}"
   local current_ref=""
 
   if [ -d "$shiv_path/.git" ]; then
diff --git a/test/lua/backend_install_test.lua b/test/lua/backend_install_test.lua
index ee3b673..44ac8fb 100644
--- a/test/lua/backend_install_test.lua
+++ b/test/lua/backend_install_test.lua
@@ -159,7 +159,7 @@ test("BackendInstall lets delegated dependency installs reenter lock", function(
                 return "/bin/mise\n"
             end
             if command:find("^git %-C '/tmp/shiv' describe") then
-                return "v0.3.2\n"
+                return "v0.3.6\n"
             end
             if command:find("^printf '%%s:%%s:%%s'") then
                 return "owner-token\n"