diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index b6a4a78fa..82a35fe9e 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -13,6 +13,9 @@ on:
 concurrency:
   group: release-plz
 
+env:
+  MISE_EXPERIMENTAL: 1
+
 jobs:
   release-plz:
     runs-on: ubuntu-latest
@@ -26,12 +29,7 @@ jobs:
           shared-key: unit
           save-if: false
       - run: mkdir -p "$HOME/bin" && echo "$HOME/bin" >> "$GITHUB_PATH"
-      - run: |
-          set -euxo pipefail
-          cargo build --all-features
-          cp target/debug/mise "$HOME"/bin
-          mise trust --all
-          mise settings set experimental true
+      - run: cargo build --all-features && cp target/debug/mise "$HOME"/bin
       - uses: actions/cache/restore@v4
         with:
           path: |
diff --git a/Cargo.lock b/Cargo.lock
index 82d67fc3a..b647be984 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -294,6 +294,15 @@ dependencies = [
  "windows-targets 0.52.4",
 ]
 
+[[package]]
+name = "ci_info"
+version = "0.14.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "840dbb7bdd1f2c4d434d6b08420ef204e0bfad0ab31a07a80a1248d24cc6e38b"
+dependencies = [
+ "envmnt",
+]
+
 [[package]]
 name = "clap"
 version = "4.5.3"
@@ -325,7 +334,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -526,7 +535,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad291aa74992b9b7a7e88c38acbbf6ad7e107f1d90ee8775b7bc1fc3394f485c"
 dependencies = [
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -554,7 +563,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -633,6 +642,12 @@ dependencies = [
  "shared_child",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56ce8c6da7551ec6c462cbaf3bfbc75131ebbfa1c944aeaa9dab51ca1c5f0c3b"
+
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -682,6 +697,16 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "envmnt"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d73999a2b8871e74c8b8bc23759ee9f3d85011b24fafc91a4b3b5c8cc8185501"
+dependencies = [
+ "fsio",
+ "indexmap 1.9.3",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.1"
@@ -827,6 +852,15 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fsio"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dad0ce30be0cc441b325c5d705c8b613a0ca0d92b6a8953d41bd236dc09a36d0"
+dependencies = [
+ "dunce",
+]
+
 [[package]]
 name = "fslock"
 version = "0.2.1"
@@ -972,13 +1006,19 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap",
+ "indexmap 2.2.5",
  "slab",
  "tokio",
  "tokio-util",
  "tracing",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
 [[package]]
 name = "hashbrown"
 version = "0.14.3"
@@ -1167,6 +1207,16 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
 
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.2.5"
@@ -1174,7 +1224,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b0b929d511467233429c45a44ac1dcaa21ba0f5ba11e4879e6ed28ddb4f9df4"
 dependencies = [
  "equivalent",
- "hashbrown",
+ "hashbrown 0.14.3",
  "serde",
 ]
 
@@ -1352,7 +1402,7 @@ checksum = "49e7bc1560b95a3c4a25d03de42fe76ca718ab92d1a22a55b9b4cf67b3ae635c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -1396,6 +1446,7 @@ dependencies = [
  "built",
  "calm_io",
  "chrono",
+ "ci_info",
  "clap",
  "clap_mangen",
  "color-eyre",
@@ -1418,7 +1469,7 @@ dependencies = [
  "home",
  "humantime",
  "indenter",
- "indexmap",
+ "indexmap 2.2.5",
  "indicatif",
  "indoc",
  "insta",
@@ -1576,7 +1627,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -1687,7 +1738,7 @@ dependencies = [
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -1708,7 +1759,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
  "fixedbitset",
- "indexmap",
+ "indexmap 2.2.5",
 ]
 
 [[package]]
@@ -2223,7 +2274,7 @@ checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -2406,7 +2457,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -2428,9 +2479,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.52"
+version = "2.0.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b699d15b36d1f02c3e7c69f8ffef53de37aefae075d8488d4ba1a7788d574a07"
+checksum = "7383cd0e49fff4b6b90ca5670bfd3e9d6a733b3f90c686605aa7eec8c4996032"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2582,7 +2633,7 @@ dependencies = [
  "cfg-if",
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -2593,7 +2644,7 @@ checksum = "5c89e72a01ed4c579669add59014b9a524d609c0c88c6a585ce37485879f6ffb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
  "test-case-core",
 ]
 
@@ -2614,7 +2665,7 @@ checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
 ]
 
 [[package]]
@@ -2751,7 +2802,7 @@ version = "0.22.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "18769cd1cec395d70860ceb4d932812a0b4d06b1a4bb336745a4d21b9496e992"
 dependencies = [
- "indexmap",
+ "indexmap 2.2.5",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -2937,7 +2988,7 @@ checksum = "b0e5b431864bf3874d7e0ab96c48d896dbce554896b98081409b530bef8267b8"
 dependencies = [
  "clap",
  "heck 0.5.0",
- "indexmap",
+ "indexmap 2.2.5",
  "itertools",
  "kdl",
  "log",
@@ -3061,7 +3112,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
  "wasm-bindgen-shared",
 ]
 
@@ -3095,7 +3146,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.52",
+ "syn 2.0.53",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 179385789..2a25fed66 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -42,6 +42,7 @@ lto = true
 base64 = "0.22.0"
 calm_io = "0.1.1"
 chrono = { version = "0.4.35", default-features = false, features = ["std", "clock"] }
+ci_info = "0.14.14"
 clap = { version = "4.5.3", features = ["env", "derive", "string"] }
 clap_mangen = { version = "0.2.20", optional = true }
 color-eyre = "0.6.3"
diff --git a/src/cli/version.rs b/src/cli/version.rs
index b2fdcda76..2c6d882d6 100644
--- a/src/cli/version.rs
+++ b/src/cli/version.rs
@@ -67,7 +67,7 @@ fn show_version() -> std::io::Result<()> {
 }
 
 fn show_latest() {
-    if *env::CI {
+    if ci_info::is_ci() && !cfg!(test) {
         return;
     }
     if let Some(latest) = check_for_new_version(duration::DAILY) {
diff --git a/src/config/config_file/mod.rs b/src/config/config_file/mod.rs
index 63771276e..dd4e889f9 100644
--- a/src/config/config_file/mod.rs
+++ b/src/config/config_file/mod.rs
@@ -222,9 +222,6 @@ pub fn is_trusted(path: &Path) -> bool {
             return true;
         }
     }
-    if !trust_path(path).exists() {
-        return false;
-    }
     if settings.paranoid {
         let trusted = trust_file_hash(path).unwrap_or_else(|e| {
             warn!("trust_file_hash: {e}");
@@ -233,6 +230,10 @@ pub fn is_trusted(path: &Path) -> bool {
         if !trusted {
             return false;
         }
+    } else if !(trust_path(path).exists() || ci_info::is_ci() && !cfg!(test)) {
+        // the file isn't trusted, and we're not on a CI system where we generally assume we can
+        // trust config files
+        return false;
     }
     cached.insert(path.to_path_buf());
     true
diff --git a/src/env.rs b/src/env.rs
index 14a0bdcab..5dd71caa1 100644
--- a/src/env.rs
+++ b/src/env.rs
@@ -115,7 +115,6 @@ pub static __MISE_WATCH: Lazy<Option<HookEnvWatches>> = Lazy::new(|| match var("
         .ok(),
     _ => None,
 });
-pub static CI: Lazy<bool> = Lazy::new(|| var_is_true("CI"));
 pub static LINUX_DISTRO: Lazy<Option<String>> = Lazy::new(linux_distro);
 pub static PREFER_STALE: Lazy<bool> = Lazy::new(|| prefer_stale(&ARGS.read().unwrap()));
 /// essentially, this is whether we show spinners or build output on runtime install