diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b95ff48e5..d4e8e116f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -117,7 +117,6 @@ jobs:
       BERD_TAURI_CARGO_TARGET_DIR: ${{ github.workspace }}/src-tauri/target
       CARGO_PROFILE_DEV_DEBUG: "0"
       CARGO_PROFILE_TEST_DEBUG: "0"
-      JUST_UNSTABLE: "1"
     steps:
       - name: Check out repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -127,7 +126,7 @@ jobs:
       - name: Install just
         uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
         with:
-          tool: just@1.40.0
+          tool: just@1.48.0
 
       - name: Restore Rust cache
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f5373610d..605d2b063 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -293,8 +293,6 @@ jobs:
       REPOSITORY: ${{ needs.setup.outputs.repository }}
       PLATFORM: ${{ needs.setup.outputs.windows_platform }}
       BERD_RELEASE_CHANNEL: disabled
-      # Windows selects generated [script] recipes that Just 1.40 still gates as unstable.
-      JUST_UNSTABLE: "1"
     steps:
       - name: Check out verified source
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -310,7 +308,7 @@ jobs:
       - name: Install just
         uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
         with:
-          tool: just@1.40.0
+          tool: just@1.48.0
 
       - name: Install pinned Node
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
diff --git a/.github/workflows/unsigned-desktop-build.yml b/.github/workflows/unsigned-desktop-build.yml
index 413e49b1d..7bd928abb 100644
--- a/.github/workflows/unsigned-desktop-build.yml
+++ b/.github/workflows/unsigned-desktop-build.yml
@@ -19,8 +19,6 @@ jobs:
             runner: windows-latest
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 240
-    env:
-      JUST_UNSTABLE: "1"
     steps:
       - name: Check out requested revision
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -31,7 +29,7 @@ jobs:
         if: runner.os == 'Windows'
         uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
         with:
-          tool: just@1.40.0
+          tool: just@1.48.0
 
       - name: Install pinned Node on Windows
         if: runner.os == 'Windows'
diff --git a/bin/.just-1.40.0.pkg b/bin/.just-1.48.0.pkg
similarity index 100%
rename from bin/.just-1.40.0.pkg
rename to bin/.just-1.48.0.pkg
diff --git a/bin/just b/bin/just
index 63271c139..46a075c7b 120000
--- a/bin/just
+++ b/bin/just
@@ -1 +1 @@
-.just-1.40.0.pkg
\ No newline at end of file
+.just-1.48.0.pkg
\ No newline at end of file
diff --git a/scripts/release/tests/release-scripts.test.mjs b/scripts/release/tests/release-scripts.test.mjs
index 488285e2e..b2d99a875 100644
--- a/scripts/release/tests/release-scripts.test.mjs
+++ b/scripts/release/tests/release-scripts.test.mjs
@@ -862,7 +862,7 @@ describe("desktop release workflow platform gate", () => {
     );
     const justVersion = run(join(repo, "bin/just"), ["--version"]);
     expect(justVersion.status, justVersion.stderr).toBe(0);
-    expect(justVersion.stdout).toContain("just 1.40.0");
+    expect(justVersion.stdout).toContain("just 1.48.0");
     const stableParse = run(join(repo, "bin/just"), ["--summary"], {
       JUST_UNSTABLE: "",
     });
@@ -898,13 +898,8 @@ describe("desktop release workflow platform gate", () => {
       ),
     );
     expect(Object.keys(provenance.artifacts)).toEqual(provenanceAssets);
-    expect(parsedWorkflow.env.JUST_UNSTABLE).toBeUndefined();
-    expect(parsedWorkflow.jobs["stage-windows"].env.JUST_UNSTABLE).toBe("1");
-    for (const [jobName, job] of Object.entries(parsedWorkflow.jobs)) {
-      if (jobName !== "stage-windows") {
-        expect(job.env?.JUST_UNSTABLE).toBeUndefined();
-      }
-    }
+    expect(workflow).toContain("tool: just@1.48.0");
+    expect(workflow).not.toContain("JUST_UNSTABLE");
     const setupSteps = parsedWorkflow.jobs.setup.steps;
     const hermitIndex = setupSteps.findIndex(
       (step) => step.name === "Activate Hermit",
@@ -944,7 +939,8 @@ describe("desktop release workflow platform gate", () => {
     );
     expect(workflow).toContain("workflow_dispatch:");
     expect(workflow).toContain("actions/upload-artifact@");
-    expect(workflow).toMatch(/env:\r?\n\s+JUST_UNSTABLE: ["']1["']/);
+    expect(workflow).toContain("tool: just@1.48.0");
+    expect(workflow).not.toContain("JUST_UNSTABLE");
     expect(workflow).toContain("node-version: 24.10.0");
     expect(workflow).toContain("corepack prepare pnpm@10.33.0 --activate");
     expect(workflow).toContain(
diff --git a/scripts/release/write-provenance.sh b/scripts/release/write-provenance.sh
index a542fed65..acbe440cd 100755
--- a/scripts/release/write-provenance.sh
+++ b/scripts/release/write-provenance.sh
@@ -25,6 +25,15 @@ validate_release_platform "$PLATFORM" || exit 1
 }
 OUTPUT_DIR="$(cd "$OUTPUT_DIR" && pwd)"
 
+if command -v shasum >/dev/null 2>&1; then
+  sha256_command=(shasum -a 256)
+elif command -v sha256sum >/dev/null 2>&1; then
+  sha256_command=(sha256sum)
+else
+  release_error "missing SHA-256 tool: expected shasum or sha256sum"
+  exit 1
+fi
+
 artifacts='{}'
 for asset_name in "$@"; do
   [[ "$asset_name" == "$(basename "$asset_name")" && "$asset_name" != "." && "$asset_name" != ".." ]] || {
@@ -40,7 +49,7 @@ for asset_name in "$@"; do
     release_error "missing or empty provenance asset: $asset_name"
     exit 1
   }
-  digest="$(shasum -a 256 "$asset" | awk '{print $1}')"
+  digest="$("${sha256_command[@]}" "$asset" | awk '{print $1}')"
   [[ "$digest" =~ ^[0-9a-f]{64}$ ]] || {
     release_error "invalid SHA-256 digest for provenance asset: $asset_name"
     exit 1