diff --git a/.github/workflows/clp-core-build-macos.yaml b/.github/workflows/clp-core-build-macos.yaml
index ebf567cdb7..a51d9b268b 100644
--- a/.github/workflows/clp-core-build-macos.yaml
+++ b/.github/workflows/clp-core-build-macos.yaml
@@ -66,6 +66,12 @@ jobs:
           rm -f /usr/local/bin/pydoc3*
           rm -f /usr/local/bin/python3*
 
+      - name: "Remove preinstalled programs which will conflict with the pipx-installed packages"
+        run: |
+          if brew list --formula cmake >/dev/null 2>&1; then
+            brew uninstall --force cmake
+          fi
+
       - name: "Install dependencies"
         run: "./components/core/tools/scripts/lib_install/macos/install-all.sh"
 
diff --git a/components/core/CMakeLists.txt b/components/core/CMakeLists.txt
index 6761324359..d758a8ffa2 100644
--- a/components/core/CMakeLists.txt
+++ b/components/core/CMakeLists.txt
@@ -1,4 +1,5 @@
-cmake_minimum_required(VERSION 3.21)
+# ystdlib requires CMake v3.23 or higher
+cmake_minimum_required(VERSION 3.23)
 
 # Toolchain setup must come before the first project() call in the entire CMake buildsystem.
 # If CLP is not the top-level project, the following setup has no effect.
diff --git a/components/core/tools/docker-images/clp-env-base-centos-stream-9/Dockerfile b/components/core/tools/docker-images/clp-env-base-centos-stream-9/Dockerfile
index 85ac66522f..4375a5c26b 100644
--- a/components/core/tools/docker-images/clp-env-base-centos-stream-9/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-centos-stream-9/Dockerfile
@@ -5,9 +5,12 @@ WORKDIR /root
 RUN mkdir -p ./tools/scripts/lib_install
 ADD ./tools/scripts/lib_install ./tools/scripts/lib_install
 
-RUN ./tools/scripts/lib_install/centos-stream-9/install-all.sh
+# Set pipx environment vars so that the pipx scripts install into the global locations without
+# passing the `--global` flag.
+ENV PIPX_BIN_DIR=/usr/local/bin
+ENV PIPX_HOME=/opt/pipx
 
-RUN pip3 install --no-cache-dir uv
+RUN ./tools/scripts/lib_install/centos-stream-9/install-all.sh
 
 # Remove cached files
 RUN dnf clean all \
diff --git a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/Dockerfile b/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/Dockerfile
index 06df2a2961..b47ab452d0 100644
--- a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/Dockerfile
@@ -5,6 +5,9 @@ WORKDIR /root
 RUN mkdir -p ./tools/scripts/lib_install
 COPY ./tools/scripts/lib_install ./tools/scripts/lib_install
 
+RUN pipx uninstall cmake
+RUN pipx uninstall uv
+
 RUN ./tools/scripts/lib_install/manylinux_2_28/install-all.sh
 
 # Remove cached files
diff --git a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/Dockerfile b/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/Dockerfile
index 1185c7d031..0a11a31f7a 100644
--- a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/Dockerfile
@@ -5,6 +5,9 @@ WORKDIR /root
 RUN mkdir -p ./tools/scripts/lib_install
 COPY ./tools/scripts/lib_install ./tools/scripts/lib_install
 
+RUN pipx uninstall cmake
+RUN pipx uninstall uv
+
 RUN ./tools/scripts/lib_install/manylinux_2_28/install-all.sh
 
 # Remove cached files
diff --git a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/Dockerfile b/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/Dockerfile
index 0aab83227d..d6e1d5cd92 100644
--- a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/Dockerfile
@@ -5,6 +5,9 @@ WORKDIR /root
 RUN mkdir -p ./tools/scripts/lib_install
 COPY ./tools/scripts/lib_install ./tools/scripts/lib_install
 
+RUN pipx uninstall cmake
+RUN pipx uninstall uv
+
 RUN ./tools/scripts/lib_install/musllinux_1_2/install-all.sh
 
 # Remove cached files
diff --git a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/Dockerfile b/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/Dockerfile
index ecdcd46e07..65e92cf197 100644
--- a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/Dockerfile
@@ -5,6 +5,9 @@ WORKDIR /root
 RUN mkdir -p ./tools/scripts/lib_install
 COPY ./tools/scripts/lib_install ./tools/scripts/lib_install
 
+RUN pipx uninstall cmake
+RUN pipx uninstall uv
+
 RUN ./tools/scripts/lib_install/musllinux_1_2/install-all.sh
 
 # Remove cached files
diff --git a/components/core/tools/docker-images/clp-env-base-ubuntu-jammy/Dockerfile b/components/core/tools/docker-images/clp-env-base-ubuntu-jammy/Dockerfile
index 6aed574188..993bb8ae82 100644
--- a/components/core/tools/docker-images/clp-env-base-ubuntu-jammy/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-ubuntu-jammy/Dockerfile
@@ -5,9 +5,12 @@ WORKDIR /root
 RUN mkdir -p ./tools/scripts/lib_install
 ADD ./tools/scripts/lib_install ./tools/scripts/lib_install
 
-RUN ./tools/scripts/lib_install/ubuntu-jammy/install-all.sh
+# Set pipx environment vars so that the pipx scripts install into the global locations without
+# passing the `--global` flag.
+ENV PIPX_BIN_DIR=/usr/local/bin
+ENV PIPX_HOME=/opt/pipx
 
-RUN pip3 install --no-cache-dir uv
+RUN ./tools/scripts/lib_install/ubuntu-jammy/install-all.sh
 
 # Remove cached files
 RUN apt-get clean \
diff --git a/components/core/tools/scripts/lib_install/centos-stream-9/install-all.sh b/components/core/tools/scripts/lib_install/centos-stream-9/install-all.sh
index a44de8130c..b24c2b96ba 100755
--- a/components/core/tools/scripts/lib_install/centos-stream-9/install-all.sh
+++ b/components/core/tools/scripts/lib_install/centos-stream-9/install-all.sh
@@ -1,15 +1,10 @@
 #!/usr/bin/env bash
 
-# Exit on any error
-set -e
+set -o errexit
+set -o nounset
+set -o pipefail
 
-# Error on undefined variable
-set -u
-
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 
 "${script_dir}/install-prebuilt-packages.sh"
 "${script_dir}/install-packages-from-source.sh"
-
-# TODO: https://github.com/y-scope/clp/issues/795
-"${script_dir}/../check-cmake-version.sh"
diff --git a/components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh b/components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
index dfa9ea749f..fa56074a58 100755
--- a/components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
+++ b/components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
@@ -1,13 +1,10 @@
 #!/usr/bin/env bash
 
-# Exit on any error
-set -e
-
-# Error on undefined variable
-set -u
+set -o errexit
+set -o nounset
+set -o pipefail
 
 dnf install -y \
-    cmake \
     diffutils \
     gcc-c++ \
     git \
@@ -23,29 +20,10 @@ dnf install -y \
     python3-pip \
     unzip
 
-# Determine architecture for `task` release to install
-rpm_arch=$(rpm --eval "%{_arch}")
-case "$rpm_arch" in
-    "x86_64")
-        task_pkg_arch="amd64"
-        ;;
-    "aarch64")
-        task_pkg_arch="arm64"
-        ;;
-    *)
-        echo "Error: Unsupported architecture - $rpm_arch"
-        exit 1
-        ;;
-esac
+if ! command -v pipx >/dev/null 2>&1; then
+    python3 -m pip install pipx
+fi
 
-# Install `task`
-# NOTE: We lock `task` to version 3.44.0 to avoid https://github.com/y-scope/clp-ffi-js/issues/110
-task_pkg_path="$(mktemp -t --suffix ".rpm" task-pkg.XXXXXXXXXX)"
-curl \
-    --fail \
-    --location \
-    --output "$task_pkg_path" \
-    --show-error \
-    "https://github.com/go-task/task/releases/download/v3.44.0/task_linux_${task_pkg_arch}.rpm"
-dnf install --assumeyes "$task_pkg_path"
-rm "$task_pkg_path"
+# Install remaining packages through pipx
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+"${script_dir}/../pipx-packages/install-all.sh"
diff --git a/components/core/tools/scripts/lib_install/check-cmake-version.sh b/components/core/tools/scripts/lib_install/check-cmake-version.sh
deleted file mode 100755
index d942b9ce98..0000000000
--- a/components/core/tools/scripts/lib_install/check-cmake-version.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-# Exit on any error
-set -e
-
-# Error on undefined variable
-set -u
-
-# Get the installed cmake version string
-cmake_version=$(cmake -E capabilities | jq --raw-output ".version.string")
-cmake_major_version=$(cmake -E capabilities | jq --raw-output ".version.major")
-
-# Check if version is 4.0 or higher
-if [[ "$cmake_major_version" -ge "4" ]]; then
-  echo "CMake version $cmake_version is currently unsupported (>= 4.0)."
-  exit 1
-fi
diff --git a/components/core/tools/scripts/lib_install/install-cmake.sh b/components/core/tools/scripts/lib_install/install-cmake.sh
deleted file mode 100755
index 140feabf1e..0000000000
--- a/components/core/tools/scripts/lib_install/install-cmake.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-
-# Exit on error
-set -e
-
-cUsage="Usage: ${BASH_SOURCE[0]} <version>"
-if [ "$#" -lt 1 ] ; then
-    echo $cUsage
-    exit
-fi
-version=$1
-
-echo "Checking for elevated privileges..."
-if [ ${EUID:-$(id -u)} -ne 0 ] ; then
-  sudo echo "Script can elevate privileges."
-fi
-
-# Get number of cpu cores
-num_cpus=$(grep -c ^processor /proc/cpuinfo)
-
-package_name=cmake
-
-# Create temp dir for installation
-temp_dir=/tmp/${package_name}-installation
-mkdir -p $temp_dir
-
-cd $temp_dir
-
-# Download source
-tar_filename=cmake-${version}.tar.gz
-curl -fsSL https://github.com/Kitware/CMake/releases/download/v${version}/${tar_filename} -o ${tar_filename}
-tar xzf ${tar_filename}
-cd cmake-${version}
-
-# Build
-./bootstrap
-make -j${num_cpus}
-
-# Install
-if [ ${EUID:-$(id -u)} -ne 0 ] ; then
-  sudo make install
-else
-  make install
-fi
-
-# Clean up
-rm -rf $temp_dir
diff --git a/components/core/tools/scripts/lib_install/macos/install-all.sh b/components/core/tools/scripts/lib_install/macos/install-all.sh
index 78327c4956..aeb70a03be 100755
--- a/components/core/tools/scripts/lib_install/macos/install-all.sh
+++ b/components/core/tools/scripts/lib_install/macos/install-all.sh
@@ -1,50 +1,30 @@
 #!/usr/bin/env bash
 
-# Exit on any error
-set -e
-
-# Error on undefined variable
-set -u
+set -o errexit
+set -o nounset
+set -o pipefail
 
 brew update
-
-# Install CMake v3.31.6 as ANTLR and yaml-cpp do not yet support CMake v4+.
-# See also: https://github.com/y-scope/clp/issues/795
-if command -v cmake ; then
-    brew uninstall --force cmake
-fi
-pipx install "cmake~=3.31"
-
-# Install a version of `task` < 3.43 to avoid https://github.com/y-scope/clp/issues/872
-if command -v task ; then
-    brew uninstall --force task
-fi
-pipx install "go-task-bin>=3.40,<3.43"
-
-# Install uv
-if ! command -v uv ; then
-    pipx install "uv>=0.8"
-fi
-
 brew install \
-  coreutils \
-  gcc \
-  java11 \
-  libarchive \
-  llvm@16 \
-  lz4 \
-  mariadb-connector-c \
-  xz \
-  zstd
+    coreutils \
+    gcc \
+    java11 \
+    libarchive \
+    llvm@16 \
+    lz4 \
+    mariadb-connector-c \
+    pipx \
+    xz \
+    zstd
 
 # Install pkg-config if it isn't already installed
 # NOTE: We might expect that pkg-config is installed through brew, so trying to install it again
 # would be harmless; however, in certain environments, like the macOS GitHub hosted runner,
 # pkg-config is installed by other means, meaning a brew install would cause conflicts.
-if ! command -v pkg-config ; then
+if ! command -v pkg-config >/dev/null 2>&1; then
     brew install pkg-config
 fi
 
-# TODO: https://github.com/y-scope/clp/issues/795
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-"${script_dir}/../check-cmake-version.sh"
+# Install remaining packages through pipx
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+"${script_dir}/../pipx-packages/install-all.sh"
diff --git a/components/core/tools/scripts/lib_install/manylinux_2_28/install-all.sh b/components/core/tools/scripts/lib_install/manylinux_2_28/install-all.sh
index 089cd6bc66..b24c2b96ba 100755
--- a/components/core/tools/scripts/lib_install/manylinux_2_28/install-all.sh
+++ b/components/core/tools/scripts/lib_install/manylinux_2_28/install-all.sh
@@ -1,12 +1,10 @@
 #!/usr/bin/env bash
 
-set -eu
+set -o errexit
+set -o nounset
 set -o pipefail
 
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 
 "${script_dir}/install-prebuilt-packages.sh"
 "${script_dir}/install-packages-from-source.sh"
-
-# TODO: https://github.com/y-scope/clp/issues/795
-"${script_dir}/../check-cmake-version.sh"
diff --git a/components/core/tools/scripts/lib_install/manylinux_2_28/install-prebuilt-packages.sh b/components/core/tools/scripts/lib_install/manylinux_2_28/install-prebuilt-packages.sh
index 48a508d71c..f73fadf19b 100755
--- a/components/core/tools/scripts/lib_install/manylinux_2_28/install-prebuilt-packages.sh
+++ b/components/core/tools/scripts/lib_install/manylinux_2_28/install-prebuilt-packages.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -eu
+set -o errexit
+set -o nounset
 set -o pipefail
 
 dnf install -y \
@@ -13,33 +14,6 @@ dnf install -y \
     zlib-devel \
     zlib-static
 
-# Determine architecture for `task` release to install
-rpm_arch=$(rpm --eval "%{_arch}")
-case "$rpm_arch" in
-    "x86_64")
-        task_pkg_arch="amd64"
-        ;;
-    "aarch64")
-        task_pkg_arch="arm64"
-        ;;
-    *)
-        echo "Error: Unsupported architecture - $rpm_arch"
-        exit 1
-        ;;
-esac
-
-# Install `task`
-# NOTE: We lock `task` to version 3.44.0 to avoid https://github.com/y-scope/clp-ffi-js/issues/110
-task_pkg_path=$(mktemp -t --suffix ".rpm" task-pkg.XXXXXXXXXX) || exit 1
-curl \
-    --fail \
-    --location \
-    --output "$task_pkg_path" \
-    --show-error \
-    "https://github.com/go-task/task/releases/download/v3.44.0/task_linux_${task_pkg_arch}.rpm"
-dnf install --assumeyes "$task_pkg_path"
-rm "$task_pkg_path"
-
-# Downgrade to CMake v3 to work around https://github.com/y-scope/clp/issues/795
-pipx uninstall cmake
-pipx install cmake~=3.31
+# Install remaining packages through pipx
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+"${script_dir}/../pipx-packages/install-all.sh"
diff --git a/components/core/tools/scripts/lib_install/musllinux_1_2/install-all.sh b/components/core/tools/scripts/lib_install/musllinux_1_2/install-all.sh
index 089cd6bc66..b24c2b96ba 100755
--- a/components/core/tools/scripts/lib_install/musllinux_1_2/install-all.sh
+++ b/components/core/tools/scripts/lib_install/musllinux_1_2/install-all.sh
@@ -1,12 +1,10 @@
 #!/usr/bin/env bash
 
-set -eu
+set -o errexit
+set -o nounset
 set -o pipefail
 
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 
 "${script_dir}/install-prebuilt-packages.sh"
 "${script_dir}/install-packages-from-source.sh"
-
-# TODO: https://github.com/y-scope/clp/issues/795
-"${script_dir}/../check-cmake-version.sh"
diff --git a/components/core/tools/scripts/lib_install/musllinux_1_2/install-prebuilt-packages.sh b/components/core/tools/scripts/lib_install/musllinux_1_2/install-prebuilt-packages.sh
index 17f29e6548..79d9dbca47 100755
--- a/components/core/tools/scripts/lib_install/musllinux_1_2/install-prebuilt-packages.sh
+++ b/components/core/tools/scripts/lib_install/musllinux_1_2/install-prebuilt-packages.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
-set -eu
+set -o errexit
+set -o nounset
 set -o pipefail
 
 apk update && apk add --no-cache \
@@ -14,34 +15,6 @@ apk update && apk add --no-cache \
     zlib-dev \
     zlib-static
 
-# Determine architecture for `task` release to install
-arch=$(uname -m)
-case "$arch" in
-    "x86_64")
-        task_pkg_arch="amd64"
-        ;;
-    "aarch64")
-        task_pkg_arch="arm64"
-        ;;
-    *)
-        echo "Error: Unsupported architecture - $arch"
-        exit 1
-        ;;
-esac
-
-# Install `task`
-# NOTE: We lock `task` to version 3.44.0 to avoid https://github.com/y-scope/clp-ffi-js/issues/110
-task_pkg_path=$(mktemp -t task-pkg.XXXXXXXXXX).tar.gz || exit 1
-curl \
-    --fail \
-    --location \
-    --output "$task_pkg_path" \
-    --show-error \
-    "https://github.com/go-task/task/releases/download/v3.44.0/task_linux_${task_pkg_arch}.tar.gz"
-tar -C /usr/local/bin -xzf "$task_pkg_path" task
-chmod +x /usr/local/bin/task
-rm "$task_pkg_path"
-
-# Downgrade to CMake v3 to work around https://github.com/y-scope/clp/issues/795
-pipx uninstall cmake
-pipx install cmake~=3.31
+# Install remaining packages through pipx
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+"${script_dir}/../pipx-packages/install-all.sh"
diff --git a/components/core/tools/scripts/lib_install/pipx-packages/install-all.sh b/components/core/tools/scripts/lib_install/pipx-packages/install-all.sh
new file mode 100755
index 0000000000..226425faff
--- /dev/null
+++ b/components/core/tools/scripts/lib_install/pipx-packages/install-all.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+"${script_dir}/install-cmake.sh"
+"${script_dir}/install-go-task.sh"
+"${script_dir}/install-uv.sh"
diff --git a/components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh b/components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh
new file mode 100755
index 0000000000..855a79b731
--- /dev/null
+++ b/components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+if ! command -v pipx >/dev/null 2>&1; then
+    echo "Error: pipx not found."
+    exit 1
+fi
+
+readonly required_version_major_min=3
+readonly required_version_minor_min=23
+readonly required_version_min="${required_version_major_min}.${required_version_minor_min}"
+readonly required_version_major_max=3
+readonly required_version_major_max_plus_1=$((required_version_major_max + 1))
+
+package_preinstalled=0
+if ! command -v cmake >/dev/null 2>&1; then
+    package_preinstalled=1
+    # ystdlib requires CMake v3.23; ANTLR and yaml-cpp do not yet support CMake v4+
+    # (see https://github.com/y-scope/clp/issues/795).
+    pipx install --force "cmake>=${required_version_min},<${required_version_major_max_plus_1}"
+    pipx ensurepath
+fi
+
+installed_version=$(cmake -E capabilities | jq --raw-output ".version.string")
+installed_version_major=$(cmake -E capabilities | jq --raw-output ".version.major")
+installed_version_minor=$(cmake -E capabilities | jq --raw-output ".version.minor")
+
+# ystdlib requires CMake v3.23; ANTLR and yaml-cpp do not yet support CMake v4+
+# (see https://github.com/y-scope/clp/issues/795).
+if (("${installed_version_major}" < "${required_version_major_min}")) \
+    || (("${installed_version_major}" == "${required_version_major_min}" && \
+    "${installed_version_minor}" < "${required_version_minor_min}")) \
+    || (("${installed_version_major}" >= "${required_version_major_max_plus_1}")); then
+    echo "Error: CMake version ${installed_version} is unsupported (require" \
+        "${required_version_min} ≤ version < ${required_version_major_max_plus_1})."
+
+    if ((0 == "${package_preinstalled}")); then
+        echo "Please uninstall CMake and then re-run the install script."
+    else
+        echo "pipx failed to install the required version of CMake."
+        echo "To uninstall, run:"
+        echo "  pipx uninstall cmake"
+    fi
+
+    exit 1
+fi
diff --git a/components/core/tools/scripts/lib_install/pipx-packages/install-go-task.sh b/components/core/tools/scripts/lib_install/pipx-packages/install-go-task.sh
new file mode 100755
index 0000000000..5923a0a4cd
--- /dev/null
+++ b/components/core/tools/scripts/lib_install/pipx-packages/install-go-task.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+if ! command -v pipx >/dev/null 2>&1; then
+    echo "Error: pipx not found."
+    exit 1
+fi
+
+# We lock to version 3.44.0 to avoid https://github.com/y-scope/clp-ffi-js/issues/110
+readonly required_version="3.44.0"
+
+package_preinstalled=0
+if ! command -v task >/dev/null 2>&1; then
+    package_preinstalled=1
+    pipx install --force "go-task-bin==${required_version}"
+    pipx ensurepath
+fi
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+task_version=$(task --silent --taskfile "${script_dir}/print-go-task-version.yaml")
+if [[ "${task_version}" != "${required_version}" ]]; then
+    echo "Error: Task version ${task_version} is currently unsupported (must be" \
+        "${required_version})."
+
+    if ((0 == "${package_preinstalled}")); then
+        echo "Please uninstall Task and then re-run the install script."
+    else
+        echo "pipx failed to install the required version of Task."
+        echo "To uninstall, run:"
+        echo "  pipx uninstall go-task-bin"
+    fi
+
+    exit 1
+fi
diff --git a/components/core/tools/scripts/lib_install/pipx-packages/install-uv.sh b/components/core/tools/scripts/lib_install/pipx-packages/install-uv.sh
new file mode 100755
index 0000000000..a368dd7192
--- /dev/null
+++ b/components/core/tools/scripts/lib_install/pipx-packages/install-uv.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+if ! command -v pipx >/dev/null 2>&1; then
+    echo "Error: pipx not found."
+    exit 1
+fi
+
+readonly required_version_major_min=0
+readonly required_version_minor_min=8
+readonly required_version_min="${required_version_major_min}.${required_version_minor_min}"
+
+package_preinstalled=0
+if ! command -v uv >/dev/null 2>&1; then
+    package_preinstalled=1
+    pipx install --force "uv>=${required_version_min}"
+    pipx ensurepath
+fi
+
+installed_version=$(uv self version --output-format json | jq --raw-output ".version")
+IFS=. read -r installd_version_major installed_version_minor _ <<<"${installed_version}"
+
+if (("${installd_version_major}" == "${required_version_major_min}" && \
+    "${installed_version_minor}" < "${required_version_minor_min}")); then
+    echo "Error: uv version ${installed_version} is unsupported (require version" \
+        "≥ ${required_version_min})."
+
+    if ((0 == "${package_preinstalled}")); then
+        echo "Please uninstall uv and then re-run the install script."
+    else
+        echo "pipx failed to install the required version of uv."
+        echo "To uninstall, run:"
+        echo "  pipx uninstall uv"
+    fi
+
+    exit 1
+fi
diff --git a/components/core/tools/scripts/lib_install/pipx-packages/print-go-task-version.yaml b/components/core/tools/scripts/lib_install/pipx-packages/print-go-task-version.yaml
new file mode 100644
index 0000000000..07961b280d
--- /dev/null
+++ b/components/core/tools/scripts/lib_install/pipx-packages/print-go-task-version.yaml
@@ -0,0 +1,6 @@
+version: "3"
+
+tasks:
+  default:
+    cmd: >-
+      echo {{ .TASK_VERSION | trimPrefix "v" }}
diff --git a/components/core/tools/scripts/lib_install/ubuntu-jammy/install-all.sh b/components/core/tools/scripts/lib_install/ubuntu-jammy/install-all.sh
index a44de8130c..b24c2b96ba 100755
--- a/components/core/tools/scripts/lib_install/ubuntu-jammy/install-all.sh
+++ b/components/core/tools/scripts/lib_install/ubuntu-jammy/install-all.sh
@@ -1,15 +1,10 @@
 #!/usr/bin/env bash
 
-# Exit on any error
-set -e
+set -o errexit
+set -o nounset
+set -o pipefail
 
-# Error on undefined variable
-set -u
-
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 
 "${script_dir}/install-prebuilt-packages.sh"
 "${script_dir}/install-packages-from-source.sh"
-
-# TODO: https://github.com/y-scope/clp/issues/795
-"${script_dir}/../check-cmake-version.sh"
diff --git a/components/core/tools/scripts/lib_install/ubuntu-jammy/install-prebuilt-packages.sh b/components/core/tools/scripts/lib_install/ubuntu-jammy/install-prebuilt-packages.sh
index f8be86614f..6e0e78b458 100755
--- a/components/core/tools/scripts/lib_install/ubuntu-jammy/install-prebuilt-packages.sh
+++ b/components/core/tools/scripts/lib_install/ubuntu-jammy/install-prebuilt-packages.sh
@@ -1,44 +1,33 @@
 #!/usr/bin/env bash
 
-# Exit on any error
-set -e
-
-# Error on undefined variable
-set -u
+set -o errexit
+set -o nounset
+set -o pipefail
 
 apt-get update
 DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \
-  ca-certificates \
-  checkinstall \
-  cmake \
-  curl \
-  build-essential \
-  git \
-  jq \
-  libcurl4 \
-  libcurl4-openssl-dev \
-  liblzma-dev \
-  libmariadb-dev \
-  libssl-dev \
-  openjdk-11-jdk \
-  pkg-config \
-  python3 \
-  python3-dev \
-  python3-pip \
-  python3-venv \
-  rsync \
-  software-properties-common \
-  unzip
+    ca-certificates \
+    checkinstall \
+    curl \
+    build-essential \
+    git \
+    jq \
+    libcurl4 \
+    libcurl4-openssl-dev \
+    liblzma-dev \
+    libmariadb-dev \
+    libssl-dev \
+    openjdk-11-jdk \
+    pipx \
+    pkg-config \
+    python3 \
+    python3-dev \
+    python3-pip \
+    python3-venv \
+    rsync \
+    software-properties-common \
+    unzip
 
-# Install `task`
-# NOTE: We lock `task` to version 3.44.0 to avoid https://github.com/y-scope/clp-ffi-js/issues/110
-task_pkg_arch=$(dpkg --print-architecture)
-task_pkg_path="$(mktemp -t --suffix ".deb" task-pkg.XXXXXXXXXX)"
-curl \
-    --fail \
-    --location \
-    --output "$task_pkg_path" \
-    --show-error \
-    "https://github.com/go-task/task/releases/download/v3.44.0/task_linux_${task_pkg_arch}.deb"
-dpkg --install "$task_pkg_path"
-rm "$task_pkg_path"
+# Install remaining packages through pipx
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+"${script_dir}/../pipx-packages/install-all.sh"
diff --git a/docs/README.md b/docs/README.md
index 7664b6628c..e24ee9243c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -14,6 +14,7 @@ this project:
 * [Node.js] >= 16 to be able to [view the output](#viewing-the-output)
 * Python 3.10 or later
 * [Task] 3.44.0
+  * We pin the version to 3.44.0 due to [y-scope/clp-ffi-js#110].
 
 ## Build Commands
 
@@ -40,8 +41,8 @@ task docs:serve
 The command above will install [http-server] and serve the built docs site; `http-server` will print
 the address it binds to (usually http://localhost:8080).
 
-[clp-issue-872]: https://github.com/y-scope/clp/issues/872
 [git-lfs]: https://git-lfs.com
 [http-server]: https://www.npmjs.com/package/http-server
 [Node.js]: https://nodejs.org/en/download/current
 [Task]: https://taskfile.dev/
+[y-scope/clp-ffi-js#110]: https://github.com/y-scope/clp-ffi-js/issues/110
diff --git a/docs/src/dev-docs/building-package.md b/docs/src/dev-docs/building-package.md
index b212b5d3c1..b899dbd706 100644
--- a/docs/src/dev-docs/building-package.md
+++ b/docs/src/dev-docs/building-package.md
@@ -14,6 +14,7 @@ prebuilt version instead, check out the [releases](https://github.com/y-scope/cl
 * python3-dev
 * python3-venv (for the version of Python installed)
 * [Task] 3.44.0
+  * We pin the version to 3.44.0 due to [y-scope/clp-ffi-js#110].
 
 ## Setup
 
@@ -78,5 +79,5 @@ task docker-images:package
 
 This will create a Docker image named `clp-package:dev`.
 
-[clp-issue-872]: https://github.com/y-scope/clp/issues/872
 [Task]: https://taskfile.dev/
+[y-scope/clp-ffi-js#110]: https://github.com/y-scope/clp-ffi-js/issues/110
diff --git a/docs/src/dev-docs/components-core/index.md b/docs/src/dev-docs/components-core/index.md
index b3413ef14c..a210243223 100644
--- a/docs/src/dev-docs/components-core/index.md
+++ b/docs/src/dev-docs/components-core/index.md
@@ -9,7 +9,11 @@ CLP core is the low-level component that performs compression, decompression, an
 * A recent compiler that fully supports C++20 features such as
   * std::span
   * std::source_location
+* [CMake] >= 3.23.0 and < 4.0.0
+  * Minimum version 3.23.0 is required for [yscope-dev-utils].
+  * We constrain the version to < 4.0.0 due to [y-scope/clp#795].
 * [Task] 3.44.0
+  * We pin the version to 3.44.0 due to [y-scope/clp-ffi-js#110].
 
 To build, we require some source dependencies, packages from package managers, and libraries built
 from source.
@@ -118,6 +122,9 @@ ubuntu-jammy-deps-install
 regex-utils
 :::
 
-[clp-issue-872]: https://github.com/y-scope/clp/issues/872
+[CMake]: https://cmake.org/
 [feature-req]: https://github.com/y-scope/clp/issues/new?assignees=&labels=enhancement&template=feature-request.yml
 [Task]: https://taskfile.dev/
+[y-scope/clp-ffi-js#110]: https://github.com/y-scope/clp-ffi-js/issues/110
+[y-scope/clp#795]: https://github.com/y-scope/clp/issues/795
+[yscope-dev-utils]: https://github.com/y-scope/yscope-dev-utils
diff --git a/docs/src/dev-docs/contributing-linting.md b/docs/src/dev-docs/contributing-linting.md
index 0a646bc681..135d43ec58 100644
--- a/docs/src/dev-docs/contributing-linting.md
+++ b/docs/src/dev-docs/contributing-linting.md
@@ -16,6 +16,7 @@ To run the linting tools, besides commonly installed tools like `tar`, you'll ne
 * Python 3.9 or newer
 * python3-venv (for the version of Python installed)
 * [Task] 3.44.0
+  * We pin the version to 3.44.0 due to [y-scope/clp-ffi-js#110].
 * [uv] >= 0.8
 
 ## Running the linters
@@ -38,4 +39,5 @@ task lint:fix
 [feature-req]: https://github.com/y-scope/clp/issues/new?assignees=&labels=enhancement&projects=&template=feature-request.yml
 [Task]: https://taskfile.dev/
 [uv]: https://docs.astral.sh/uv/
+[y-scope/clp-ffi-js#110]: https://github.com/y-scope/clp-ffi-js/issues/110
 [yscope-dev-utils]: https://github.com/y-scope/yscope-dev-utils
diff --git a/taskfiles/lint.yaml b/taskfiles/lint.yaml
index 2cf23949ff..758f1b15ee 100644
--- a/taskfiles/lint.yaml
+++ b/taskfiles/lint.yaml
@@ -100,6 +100,7 @@ tasks:
           .yamllint.yml \
           components/core/.clang-format \
           components/core/config \
+          components/core/tools/ \
           components/package-template/src/etc \
           docs \
           taskfile.yaml \