diff --git a/capabilities/web-security/capability.yaml b/capabilities/web-security/capability.yaml
index aed0448..6ab36ee 100644
--- a/capabilities/web-security/capability.yaml
+++ b/capabilities/web-security/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: web-security
-version: "1.0.3"
+version: "1.0.4"
 description: >
   Web application penetration testing with 30+ attack technique playbooks
   covering request smuggling, cache poisoning, SSRF, SSTI, DOM
@@ -66,7 +66,7 @@ checks:
   - name: nuclei
     command: 'command -v nuclei >/dev/null 2>&1 || test -x "$HOME/.pdtm/go/bin/nuclei"'
   - name: httpx
-    command: 'command -v httpx >/dev/null 2>&1 || test -x "$HOME/.pdtm/go/bin/httpx"'
+    command: 'httpx -version >/dev/null 2>&1 || "$HOME/.pdtm/go/bin/httpx" -version >/dev/null 2>&1'
   - name: interactsh-client
     command: 'command -v interactsh-client >/dev/null 2>&1 || test -x "$HOME/go/bin/interactsh-client"'
   - name: protoscope
diff --git a/capabilities/web-security/scripts/install_tools.sh b/capabilities/web-security/scripts/install_tools.sh
index 6978ed7..28fe208 100755
--- a/capabilities/web-security/scripts/install_tools.sh
+++ b/capabilities/web-security/scripts/install_tools.sh
@@ -5,47 +5,88 @@ set -euo pipefail
 
 ARCH="$(uname -m)"
 
-# -- Go toolchain (needed for pdtm, protoscope, interactsh, surf) ---------
-if ! command -v go &>/dev/null; then
-  GO_VERSION="1.24.3"
+# The self-hosted runtime prebakes these tools. Keep this installer as a fallback
+# for other sandbox providers, but never replace a binary that is already on PATH.
+ensure_go() {
+  export PATH="$HOME/go/bin:$PATH"
+  if command -v go &>/dev/null; then
+    return
+  fi
+
+  GO_VERSION="1.26.6"
   case "$ARCH" in
     aarch64|arm64) GOARCH="arm64" ;;
     *)             GOARCH="amd64" ;;
   esac
   curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz" | tar -xz -C /usr/local
-  export PATH="/usr/local/go/bin:$HOME/go/bin:$PATH"
-fi
+  export PATH="/usr/local/go/bin:$PATH"
+}
+
+# -- ProjectDiscovery tools -----------------------------------------------
+install_pd_tool() {
+  local tool="$1" package="$2" version="$3"
+  if command -v "$tool" &>/dev/null; then
+    if [[ "$tool" != "httpx" ]] || "$tool" -version &>/dev/null; then
+      return
+    fi
+  fi
 
-# -- PDTM + ProjectDiscovery tools ----------------------------------------
-go install github.com/projectdiscovery/pdtm/cmd/pdtm@latest
-pdtm -install nuclei,httpx,subfinder,naabu,dnsx,uncover,alterx,tlsx,asnmap
-export PATH="$HOME/.pdtm/go/bin:$PATH"
+  ensure_go
+  mkdir -p "$HOME/.pdtm/go/bin"
+  GOBIN="$HOME/.pdtm/go/bin" go install "${package}@${version}"
+  export PATH="$HOME/.pdtm/go/bin:$PATH"
+}
+
+install_pd_tool nuclei github.com/projectdiscovery/nuclei/v3/cmd/nuclei v3.11.1
+install_pd_tool httpx github.com/projectdiscovery/httpx/cmd/httpx v1.12.0
+install_pd_tool subfinder github.com/projectdiscovery/subfinder/v2/cmd/subfinder v2.16.0
+install_pd_tool naabu github.com/projectdiscovery/naabu/v2/cmd/naabu v2.6.1
+install_pd_tool dnsx github.com/projectdiscovery/dnsx/cmd/dnsx v1.3.1
+install_pd_tool uncover github.com/projectdiscovery/uncover/cmd/uncover v1.2.1
+install_pd_tool alterx github.com/projectdiscovery/alterx/cmd/alterx v0.1.0
+install_pd_tool tlsx github.com/projectdiscovery/tlsx/cmd/tlsx v1.4.0
+install_pd_tool asnmap github.com/projectdiscovery/asnmap/cmd/asnmap v1.1.1
 
 # -- katana (pre-built binary, go-tree-sitter build issue) -----------------
-KATANA_VERSION="1.5.0"
-DEB_ARCH="$(dpkg --print-architecture 2>/dev/null || echo amd64)"
-curl -fsSL "https://github.com/projectdiscovery/katana/releases/download/v${KATANA_VERSION}/katana_${KATANA_VERSION}_linux_${DEB_ARCH}.zip" \
-  -o /tmp/katana.zip
-unzip -o /tmp/katana.zip -d /tmp/katana_extract
-mv /tmp/katana_extract/katana "$HOME/.pdtm/go/bin/katana"
-chmod +x "$HOME/.pdtm/go/bin/katana"
-rm -rf /tmp/katana.zip /tmp/katana_extract
+if ! command -v katana &>/dev/null; then
+  KATANA_VERSION="1.7.0"
+  DEB_ARCH="$(dpkg --print-architecture 2>/dev/null || echo amd64)"
+  mkdir -p "$HOME/.pdtm/go/bin"
+  curl -fsSL "https://github.com/projectdiscovery/katana/releases/download/v${KATANA_VERSION}/katana_${KATANA_VERSION}_linux_${DEB_ARCH}.zip" \
+    -o /tmp/katana.zip
+  unzip -o /tmp/katana.zip -d /tmp/katana_extract
+  mv /tmp/katana_extract/katana "$HOME/.pdtm/go/bin/katana"
+  chmod +x "$HOME/.pdtm/go/bin/katana"
+  rm -rf /tmp/katana.zip /tmp/katana_extract
+fi
 
 # -- protoscope ------------------------------------------------------------
-go install github.com/protocolbuffers/protoscope/cmd/protoscope@latest
+if ! command -v protoscope &>/dev/null; then
+  ensure_go
+  go install github.com/protocolbuffers/protoscope/cmd/protoscope@v0.0.0-20221109213918-8e7a6aafa2c9
+fi
 
 # -- interactsh-client -----------------------------------------------------
-go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest
+if ! command -v interactsh-client &>/dev/null; then
+  ensure_go
+  go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@v1.3.1
+fi
 
 # -- 2fa (TOTP generator) --------------------------------------------------
-go install rsc.io/2fa@latest
+if ! command -v 2fa &>/dev/null; then
+  ensure_go
+  go install rsc.io/2fa@v1.2.0
+fi
 
 # -- surf (SSRF target identification) ------------------------------------
-go install github.com/assetnote/surf/cmd/surf@latest
+if ! command -v surf &>/dev/null; then
+  ensure_go
+  go install github.com/assetnote/surf/cmd/surf@v0.0.5
+fi
 
 # -- kiterunner (API content discovery) ------------------------------------
 if ! command -v kr &>/dev/null; then
-  git clone --depth 1 https://github.com/assetnote/kiterunner /tmp/kiterunner
+  git clone --depth 1 --branch v1.0.2 https://github.com/assetnote/kiterunner /tmp/kiterunner
   cd /tmp/kiterunner && make build
   mv /tmp/kiterunner/dist/kr /usr/local/bin/kr
   rm -rf /tmp/kiterunner
@@ -97,14 +138,21 @@ elif ! command -v jxscout-pro-v2 &>/dev/null; then
 fi
 
 # -- Node.js + agent-browser -----------------------------------------------
-if ! command -v node &>/dev/null; then
-  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+NODE_MAJOR="$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)"
+if ((NODE_MAJOR < 24)); then
+  curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
   apt-get install -y --no-install-recommends nodejs
 fi
-npm install -g agent-browser
-agent-browser install || true
+if ! command -v agent-browser &>/dev/null; then
+  npm install -g agent-browser@0.35.0
+fi
+if [[ "${DREADNODE_CAPABILITY_INSTALL:-}" != "sealed" ]]; then
+  agent-browser install
+fi
 
 # -- Clean up Go build cache -----------------------------------------------
-go clean -cache -modcache 2>/dev/null || true
+if command -v go &>/dev/null; then
+  go clean -cache -modcache 2>/dev/null || true
+fi
 
 echo "web-security tools installed successfully"