diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4d029822..a055e7c0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,7 +16,7 @@ on:
   workflow_dispatch:
     inputs:
       dist-tag:
-        description: "npm dist-tag. Empty = the version's canonical tag (next on the RC line, latest for stable). Pass latest explicitly to move latest onto an RC — that is the deliberate cutover act."
+        description: "npm dist-tag. Empty = latest, the canonical tag for every release since the 2026-08-25 cutover. Pass another tag (e.g. beta) for a hand-cut preview."
         required: false
         default: ""
         type: string
diff --git a/docs/oss/versioning.md b/docs/oss/versioning.md
index 386dc373..09f8839f 100644
--- a/docs/oss/versioning.md
+++ b/docs/oss/versioning.md
@@ -8,9 +8,9 @@ Prisma 8 ships as a release-candidate line ahead of `8.0.0` final: releases are
 
 RC respins may include breaking changes until `8.0.0` final ships. There are no patch releases on the RC line — a fix ships as the next `rc.N`.
 
-For the packages this repository's publish workflow ships (`prisma`, `@prisma/cli`, `@prisma/cli-engine`), **each release publishes under its line's canonical dist-tag**: RC-line versions under `next`, stable versions under `latest` (operator ruling 2026-08-12; supersedes the earlier "`latest` tracks the newest release, RC or stable"). A dist-tag moves only through a deliberately merged version-bump PR (or a manual `workflow_dispatch`); creating and merging the bump PR is the operator's explicit act. `latest` stays on the pre-8 CLI until the operator moves it deliberately. Existing installs are unaffected — lockfiles pin resolved versions, and nobody lands on the RC line without asking for `@next`.
+For the packages this repository's publish workflow ships (`prisma`, `@prisma/cli`, `@prisma/cli-engine`), **every release publishes under `latest`, RC-line versions included** (operator cutover ruling 2026-08-25, executing rollout-plan step 5; supersedes the 2026-08-12 "RC under `next`" ruling). A dist-tag moves only through a deliberately merged version-bump PR (or a manual `workflow_dispatch`); creating and merging the bump PR is the operator's explicit act. Existing installs are unaffected — lockfiles pin resolved versions.
 
-**The bare `prisma` name is what this discipline is for.** Its `latest` serves Prisma 7 (`7.9.1`) to everyone who types `npm install prisma`, so the v8 line lives on `next` until a deliberate cutover. The products' packages are all new — nobody is installing `@prisma/composer-cli` or `@prisma/orm-toolchain` expecting a version 7 — so they publish releases straight to `latest`, pre-release versions included, and this repository follows `latest` for them (operator ruling 2026-08-17).
+**History of the bare `prisma` name.** Its `latest` served Prisma 7 (`7.9.1`) until the 2026-08-25 cutover, so the v8 RC line lived on `next` while it matured. The product-family packages (`@prisma/composer-cli`, `@prisma/orm-toolchain` and their siblings — not this repository's three) were never held back — all new names with no version-7 audience — so they always published releases straight to `latest`, pre-release versions included, and this repository follows `latest` for them (operator ruling 2026-08-17).
 
 The transition onto the RC line is a one-time bump from the pre-8 base to `8.0.0-rc.1`; `pnpm bump-version` encodes it (a pre-8 stable base advances to `8.0.0-rc.1`, an RC base advances its counter).
 
@@ -39,11 +39,11 @@ This is enforced, not remembered: the conformance checks refuse to publish a rel
 
 The npm registry exposes the CLI packages under these dist-tags:
 
-- **`latest`** — what a bare `npm install` gets. It stays on the pre-8 CLI while the Prisma 8 RC line matures; moving it to 8.x is a deliberate operator act (dispatching the publish workflow with `dist-tag: latest`, or widening `releaseDistTag` when the RC line is ready), not a side effect of any routine release (operator ruling 2026-08-12). Once the line is stable, stable release bumps publish here.
-- **`next`** — the Prisma 8 RC line (`8.0.0-rc.N`). A merged release PR on the RC line publishes here automatically.
+- **`latest`** — what a bare `npm install` gets: the newest release, RC or stable. A merged release PR publishes here automatically (operator cutover ruling 2026-08-25; before it, `latest` stayed on the pre-8 CLI and the RC line lived on `next`).
+- **`next`** — retired by the cutover: it froze at the last pre-cutover RC and the publish path no longer moves it (operator ruling 2026-08-25). Keeping it synced to `latest` was considered and dropped — re-pointing a tag on an already-published version cannot authenticate over OIDC, and npm has no token permission narrower than package write, so a standing sync would mean a standing publish-capable token. The operator re-points or removes the tag by hand (`scripts/cutover-dist-tags.sh`); text that says `prisma@next` should move to plain `prisma`.
 - **`beta`** — reserved for hand-cut previews ahead of significant changes, published by dispatching the workflow with that dist-tag. Routine releases do not use this tag.
 
-- **`dev`** — every routine push to `main` publishes `<base>-dev.<run>` here automatically (operator ruling 2026-08-13, superseding the earlier "no dev channel" ruling). The suffix derives from the workflow run number and is stamped ephemerally in CI, never committed, so release versions remain exactly what a commit says. The channel exists so a product's new version reaches a working CLI without a human: an auto-merging pull request moves the version, runs the full quality and conformance checks, and its merge ships the dev build. Today a daily scheduled run is what notices a product release; the immediate path needs a notification step in each product repository, which neither has yet. See [release automation](./release-automation.md). Only a real release — an `rc.N` bump under `next`, or moving `latest` — is a human act.
+- **`dev`** — every routine push to `main` publishes `<base>-dev.<run>` here automatically (operator ruling 2026-08-13, superseding the earlier "no dev channel" ruling). The suffix derives from the workflow run number and is stamped ephemerally in CI, never committed, so release versions remain exactly what a commit says. The channel exists so a product's new version reaches a working CLI without a human: an auto-merging pull request moves the version, runs the full quality and conformance checks, and its merge ships the dev build. Today a daily scheduled run is what notices a product release; the immediate path needs a notification step in each product repository, which neither has yet. See [release automation](./release-automation.md). Only a real release — a merged `rc.N` bump publishing under `latest` — is a human act.
 
   **Every** run of the publish workflow ships a dev build, including the one that cuts a release — the release publish is an additional half, not an alternative (operator ruling 2026-08-18). When they were alternatives, the release commit was the one merge to `main` that never reached the dev channel, so `dev` named an older version than the release until an unrelated commit landed. The dev build is published as its own version rather than by moving the `dev` tag, because OIDC trusted publishing authorises `npm publish` and nothing else.
 
@@ -68,7 +68,7 @@ This is by design. The alternatives cause silent problems:
 
 [`scripts/set-version.ts`](../../scripts/set-version.ts) is what enforces lockstep: a single invocation walks every lockstep workspace `package.json` and writes the requested version (rewriting `workspace:` dependency pins to match). It is a maintainer's tool, invoked through `pnpm bump-version`; the publish workflow does not run it.
 
-The publish workflow is **triggered by a change to the root `version`**: a push to `main` whose root `package.json` carries a different `version` than the previous tip is recognised as a release bump and ships that version under its canonical dist-tag — `next` on the RC line (the accompanying GitHub Release is marked pre-release), `latest` for stable. This is what makes "merge the release PR" the publish trigger; there is no separate dispatch step. Every push publishes a `dev` build; one that changes the version publishes a release as well (operator ruling 2026-08-18). Within a publish, `@prisma/cli-engine` goes first, then `@prisma/cli` (which depends on it), then `prisma`.
+The publish workflow is **triggered by a change to the root `version`**: a push to `main` whose root `package.json` carries a different `version` than the previous tip is recognised as a release bump and ships that version under `latest` (the accompanying GitHub Release is marked pre-release on the RC line). This is what makes "merge the release PR" the publish trigger; there is no separate dispatch step. Every push publishes a `dev` build; one that changes the version publishes a release as well (operator ruling 2026-08-18). Within a publish, `@prisma/cli-engine` goes first, then `@prisma/cli` (which depends on it), then `prisma`.
 
 **Nothing rewrites a `version` field outside a commit.** `set-version.ts` is run by `pnpm bump-version`, whose output a maintainer reviews and commits; the publish workflow never invokes it. That is what makes "the version is whatever `package.json` says" true rather than aspirational — CI has no way to ship a version no commit describes. It also keeps `pnpm-lock.yaml` honest: the lockfile records the `workspace:` specifiers that `set-version.ts` rewrites, so `bump-version` refreshes it in the same breath and the bump lands as one internally consistent commit.
 
@@ -81,9 +81,9 @@ Before anything reaches the registry, the workflow verifies the artifact it is a
 The release cadence is one PR per release (on the RC line: one PR per `rc.N`). A maintainer:
 
 1. **Runs the [`publish-npm-version` skill](../../skills-contrib/publish-npm-version/SKILL.md)**, which drives `pnpm bump-version` in a fresh worktree off `origin/main` and opens the release PR under real maintainer credentials (so CI runs on it normally). The script reads the root version committed at HEAD, computes the next release version (`8.0.0-rc.N` → `8.0.0-rc.N+1`), and writes it to every lockstep `package.json`. `bump-version` refreshes `pnpm-lock.yaml` itself, because the lockfile records the `workspace:` pins it rewrites and a stale one fails every later frozen install. Commit both and open a `chore(release): 8.0.0-rc.N+1` PR.
-2. **Reviews and merges the PR.** This is the point where a human verifies the release is intended — merging the bump PR is the deliberate act that publishes. The resulting push to `main` carries the bumped root `version`, the publish workflow detects the change, publishes under the line's canonical dist-tag (`next` on the RC line, `latest` for stable), and creates a matching GitHub Release (marked pre-release on the RC line).
+2. **Reviews and merges the PR.** This is the point where a human verifies the release is intended — merging the bump PR is the deliberate act that publishes. The resulting push to `main` carries the bumped root `version`, the publish workflow detects the change, publishes under `latest`, and creates a matching GitHub Release (marked pre-release on the RC line).
 
-If the publish needs to be re-run (transient registry failure, etc.), a maintainer can dispatch the [`Publish to npm`](../../.github/workflows/publish.yml) workflow from `main` with the version's canonical dist-tag (`next` on the RC line, `latest` for stable) and `dry-run=false`; the workflow re-publishes the version currently committed at HEAD, and because the chosen tag matches the canonical one it also re-creates the GitHub Release if it is missing. This is the same path used to cut a hand-rolled `beta` (`dist-tag=beta`, no Release).
+If the publish needs to be re-run (transient registry failure, etc.), a maintainer can dispatch the [`Publish to npm`](../../.github/workflows/publish.yml) workflow from `main` with `dist-tag: latest` and `dry-run=false`; the workflow re-publishes the version currently committed at HEAD, and because the chosen tag matches the canonical one it also re-creates the GitHub Release if it is missing. This is the same path used to cut a hand-rolled `beta` (`dist-tag=beta`, no Release).
 
 ## Procedure: validate publish changes
 
diff --git a/package.json b/package.json
index 6e605b93..066ac815 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "prisma-cli",
-  "version": "8.0.0-rc.9",
+  "version": "8.0.0-rc.10",
   "private": true,
   "engines": {
     "node": ">=24"
diff --git a/packages/cli-conformance/package.json b/packages/cli-conformance/package.json
index fba846c2..3a4d49bc 100644
--- a/packages/cli-conformance/package.json
+++ b/packages/cli-conformance/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@repo/cli-conformance",
   "private": true,
-  "version": "8.0.0-rc.9",
+  "version": "8.0.0-rc.10",
   "description": "Reusable conformance checks for the engine's consumers: import purity over built output, config-section validators that never throw, and verification of the tarballs a registry would receive. Depends on no package it checks.",
   "type": "module",
   "exports": {
@@ -24,7 +24,7 @@
     "test": "pnpm run typecheck && vitest run"
   },
   "devDependencies": {
-    "@repo/tsconfig": "workspace:8.0.0-rc.9",
+    "@repo/tsconfig": "workspace:8.0.0-rc.10",
     "@types/node": "^22.19.19",
     "es-module-lexer": "^2.1.0",
     "tsx": "^4.22.4",
diff --git a/packages/cli-engine/package.json b/packages/cli-engine/package.json
index 925ed028..ba0dd711 100644
--- a/packages/cli-engine/package.json
+++ b/packages/cli-engine/package.json
@@ -55,8 +55,8 @@
     "string-width": "^8.2.1"
   },
   "devDependencies": {
-    "@repo/cli-conformance": "workspace:8.0.0-rc.9",
-    "@repo/tsconfig": "workspace:8.0.0-rc.9",
+    "@repo/cli-conformance": "workspace:8.0.0-rc.10",
+    "@repo/tsconfig": "workspace:8.0.0-rc.10",
     "@types/node": "^22.19.19",
     "ci-info": "^4.3.1",
     "tsdown": "^0.21.10",
diff --git a/packages/cli-telemetry/package.json b/packages/cli-telemetry/package.json
index 836ce45b..b63c484a 100644
--- a/packages/cli-telemetry/package.json
+++ b/packages/cli-telemetry/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@repo/cli-telemetry",
   "private": true,
-  "version": "8.0.0-rc.9",
+  "version": "8.0.0-rc.10",
   "description": "CLI telemetry child sender: the detached subprocess the engine hands a composed payload to, its system probes, and the POST",
   "type": "module",
   "sideEffects": [
@@ -35,7 +35,7 @@
     "@vercel/detect-agent": "^1.2.3"
   },
   "devDependencies": {
-    "@repo/tsconfig": "workspace:8.0.0-rc.9",
+    "@repo/tsconfig": "workspace:8.0.0-rc.10",
     "@types/node": "^22.19.19",
     "tsdown": "^0.21.10",
     "typescript": "^6.0.3",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index d9f983b8..4bfa3332 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "8.0.0-rc.9",
+  "version": "8.0.0-rc.10",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {
@@ -50,11 +50,11 @@
   "dependencies": {
     "@manypkg/tools": "^2.1.2",
     "@prisma/cli-engine": "workspace:0.2.3",
-    "@prisma/composer-cli": "0.13.0",
+    "@prisma/composer-cli": "0.14.0",
     "@prisma/compute-sdk": "0.39.0",
     "@prisma/credentials-store": "^7.8.0",
     "@prisma/management-api-sdk": "1.55.0",
-    "@prisma/orm-toolchain": "8.0.0-rc.6",
+    "@prisma/orm-toolchain": "8.0.0-rc.7",
     "@vercel/detect-agent": "^1.2.3",
     "better-result": "^2.9.2",
     "dotenv": "^17.4.2",
@@ -62,10 +62,10 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@prisma/composer": "0.13.0",
-    "@repo/cli-conformance": "workspace:8.0.0-rc.9",
-    "@repo/cli-telemetry": "workspace:8.0.0-rc.9",
-    "@repo/tsconfig": "workspace:8.0.0-rc.9",
+    "@prisma/composer": "0.14.0",
+    "@repo/cli-conformance": "workspace:8.0.0-rc.10",
+    "@repo/cli-telemetry": "workspace:8.0.0-rc.10",
+    "@repo/tsconfig": "workspace:8.0.0-rc.10",
     "@types/node": "^22.19.19",
     "tsdown": "^0.21.10",
     "tsx": "^4.22.4",
diff --git a/packages/cli/scripts/conformance.ts b/packages/cli/scripts/conformance.ts
index eba23aa2..230308f5 100644
--- a/packages/cli/scripts/conformance.ts
+++ b/packages/cli/scripts/conformance.ts
@@ -109,34 +109,13 @@ async function tarball(): Promise<readonly Finding[]> {
       shellPackage: "@prisma/cli",
       enginePackage: "@prisma/cli-engine",
       familyPackages: ["@prisma/composer-cli", "@prisma/orm-toolchain"],
-      // The empty list is the goal state: both families peering the
-      // exact engine version this repo ships, one engine per install
-      // (ADR 0004). The two entries below are an engine version
-      // transition in flight — a family cannot peer an engine version
-      // that is not on the registry, so the engine publishes first and
-      // the mismatch is real until both families release against it.
-      // The entries expire with the versions they name, and the PR
-      // that pins the families' 0.2.3 releases removes them; while
-      // they stand, a release could ship the two-engine install they
-      // describe, which is why they must not outlive the transition.
-      exceptions: [
-        {
-          familyPackage: "@prisma/composer-cli",
-          familyPin: "0.2.2",
-          shellPin: "0.2.3",
-          reason: "engine 0.2.3 must publish before composer-cli can peer it",
-          removeWhen:
-            "composer-cli releases peering 0.2.3 and the follow-up bump PR pins that release",
-        },
-        {
-          familyPackage: "@prisma/orm-toolchain",
-          familyPin: "0.2.2",
-          shellPin: "0.2.3",
-          reason: "engine 0.2.3 must publish before orm-toolchain can peer it",
-          removeWhen:
-            "orm-toolchain releases peering 0.2.3 and the follow-up bump PR pins that release",
-        },
-      ],
+      // No exceptions. Both families declare @prisma/cli-engine as an
+      // exact peer at the version this repo ships, so one engine
+      // resolves in an install — what ADR 0004 asks for. An entry here
+      // exists only while an engine version transition is in flight
+      // (the engine must publish before a family can peer it), and the
+      // release PR that pins the families' new versions removes it.
+      exceptions: [],
       channel: CHANNEL,
       sandboxDir: join(WORK_DIR, "sandbox"),
     },
diff --git a/packages/compute/package.json b/packages/compute/package.json
index 3c69d683..df9be91f 100644
--- a/packages/compute/package.json
+++ b/packages/compute/package.json
@@ -42,7 +42,7 @@
     "test": "vitest run"
   },
   "devDependencies": {
-    "@repo/tsconfig": "workspace:8.0.0-rc.9",
+    "@repo/tsconfig": "workspace:8.0.0-rc.10",
     "@types/node": "^22.19.19",
     "tsdown": "^0.21.10",
     "typescript": "^6.0.3",
diff --git a/packages/prisma/package.json b/packages/prisma/package.json
index 8a31360e..0efb77b4 100644
--- a/packages/prisma/package.json
+++ b/packages/prisma/package.json
@@ -1,6 +1,6 @@
 {
   "name": "prisma",
-  "version": "8.0.0-rc.9",
+  "version": "8.0.0-rc.10",
   "description": "The Prisma CLI: one binary for the ORM, Composer, and the Prisma Developer Platform.",
   "type": "module",
   "bin": {
@@ -50,11 +50,11 @@
   "dependencies": {
     "@manypkg/tools": "^2.1.2",
     "@prisma/cli-engine": "workspace:0.2.3",
-    "@prisma/composer-cli": "0.13.0",
+    "@prisma/composer-cli": "0.14.0",
     "@prisma/compute-sdk": "0.39.0",
     "@prisma/credentials-store": "^7.8.0",
     "@prisma/management-api-sdk": "1.55.0",
-    "@prisma/orm-toolchain": "8.0.0-rc.6",
+    "@prisma/orm-toolchain": "8.0.0-rc.7",
     "@vercel/detect-agent": "^1.2.3",
     "better-result": "^2.9.2",
     "dotenv": "^17.4.2",
@@ -62,9 +62,9 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@prisma/cli": "workspace:8.0.0-rc.9",
-    "@repo/cli-telemetry": "workspace:8.0.0-rc.9",
-    "@repo/tsconfig": "workspace:8.0.0-rc.9",
+    "@prisma/cli": "workspace:8.0.0-rc.10",
+    "@repo/cli-telemetry": "workspace:8.0.0-rc.10",
+    "@repo/tsconfig": "workspace:8.0.0-rc.10",
     "@types/node": "^22.19.19",
     "tsdown": "^0.21.10",
     "typescript": "^6.0.3",
diff --git a/packages/tsconfig/package.json b/packages/tsconfig/package.json
index 3be07542..8914ba69 100644
--- a/packages/tsconfig/package.json
+++ b/packages/tsconfig/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@repo/tsconfig",
   "private": true,
-  "version": "8.0.0-rc.9",
+  "version": "8.0.0-rc.10",
   "description": "Base tsconfig providing package for the monorepo",
   "license": "Apache-2.0",
   "files": [
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index aeeeb1e7..2d5d119f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -30,8 +30,8 @@ importers:
         specifier: workspace:0.2.3
         version: link:../cli-engine
       '@prisma/composer-cli':
-        specifier: 0.13.0
-        version: 0.13.0(@prisma/cli-engine@packages+cli-engine)(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
+        specifier: 0.14.0
+        version: 0.14.0(@prisma/cli-engine@packages+cli-engine)(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
       '@prisma/compute-sdk':
         specifier: 0.39.0
         version: 0.39.0(@prisma/management-api-sdk@1.55.0)(rollup@4.62.2)
@@ -42,8 +42,8 @@ importers:
         specifier: 1.55.0
         version: 1.55.0
       '@prisma/orm-toolchain':
-        specifier: 8.0.0-rc.6
-        version: 8.0.0-rc.6(@prisma/cli-engine@packages+cli-engine)(magicast@0.5.3)(typanion@3.14.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))
+        specifier: 8.0.0-rc.7
+        version: 8.0.0-rc.7(@prisma/cli-engine@packages+cli-engine)(magicast@0.5.3)(typanion@3.14.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))
       '@vercel/detect-agent':
         specifier: ^1.2.3
         version: 1.2.4
@@ -61,16 +61,16 @@ importers:
         version: 11.0.0
     devDependencies:
       '@prisma/composer':
-        specifier: 0.13.0
-        version: 0.13.0(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
+        specifier: 0.14.0
+        version: 0.14.0(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
       '@repo/cli-conformance':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../cli-conformance
       '@repo/cli-telemetry':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../cli-telemetry
       '@repo/tsconfig':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../tsconfig
       '@types/node':
         specifier: ^22.19.19
@@ -91,7 +91,7 @@ importers:
   packages/cli-conformance:
     devDependencies:
       '@repo/tsconfig':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../tsconfig
       '@types/node':
         specifier: ^22.19.19
@@ -134,10 +134,10 @@ importers:
         version: 8.2.1
     devDependencies:
       '@repo/cli-conformance':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../cli-conformance
       '@repo/tsconfig':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../tsconfig
       '@types/node':
         specifier: ^22.19.19
@@ -162,7 +162,7 @@ importers:
         version: 1.2.4
     devDependencies:
       '@repo/tsconfig':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../tsconfig
       '@types/node':
         specifier: ^22.19.19
@@ -180,7 +180,7 @@ importers:
   packages/compute:
     devDependencies:
       '@repo/tsconfig':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../tsconfig
       '@types/node':
         specifier: ^22.19.19
@@ -204,8 +204,8 @@ importers:
         specifier: workspace:0.2.3
         version: link:../cli-engine
       '@prisma/composer-cli':
-        specifier: 0.13.0
-        version: 0.13.0(@prisma/cli-engine@packages+cli-engine)(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
+        specifier: 0.14.0
+        version: 0.14.0(@prisma/cli-engine@packages+cli-engine)(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
       '@prisma/compute-sdk':
         specifier: 0.39.0
         version: 0.39.0(@prisma/management-api-sdk@1.55.0)(rollup@4.62.2)
@@ -216,8 +216,8 @@ importers:
         specifier: 1.55.0
         version: 1.55.0
       '@prisma/orm-toolchain':
-        specifier: 8.0.0-rc.6
-        version: 8.0.0-rc.6(@prisma/cli-engine@packages+cli-engine)(magicast@0.5.3)(typanion@3.14.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))
+        specifier: 8.0.0-rc.7
+        version: 8.0.0-rc.7(@prisma/cli-engine@packages+cli-engine)(magicast@0.5.3)(typanion@3.14.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))
       '@vercel/detect-agent':
         specifier: ^1.2.3
         version: 1.2.4
@@ -235,13 +235,13 @@ importers:
         version: 11.0.0
     devDependencies:
       '@prisma/cli':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../cli
       '@repo/cli-telemetry':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../cli-telemetry
       '@repo/tsconfig':
-        specifier: workspace:8.0.0-rc.9
+        specifier: workspace:8.0.0-rc.10
         version: link:../tsconfig
       '@types/node':
         specifier: ^22.19.19
@@ -1329,15 +1329,15 @@ packages:
   '@oxc-project/types@0.139.0':
     resolution: {integrity: sha512-r9gHphtCs+1M7J0pw6Sn/hh/Wpa/iQrOOkrNAlVLF/gHq+/CJmHIWKKUUhdWjcD6CIa8idarspCsASiXCXvFUw==}
 
-  '@prisma/composer-cli@0.13.0':
-    resolution: {integrity: sha512-6qYLVcbksDCvG7Xuglv5KD3y6uWdwKtKU4PyVYxvHRoLrm5t/zSnIv4Rh0WFS2FZeSU5YDDj6K0dODj2uAMkxw==}
+  '@prisma/composer-cli@0.14.0':
+    resolution: {integrity: sha512-07LbfPHvj3Qm4hrheYzPmsWP5Ob6S9nahEHtp+0o9JRr/yeq/hiuBdtjaIgoZ6EAk1Dxp1JuvZ7rCXIXvnYWsA==}
     engines: {node: '>=22.18.0'}
     hasBin: true
     peerDependencies:
-      '@prisma/cli-engine': 0.2.2
+      '@prisma/cli-engine': 0.2.3
 
-  '@prisma/composer@0.13.0':
-    resolution: {integrity: sha512-o73iFmsC2liTwBi+ysHmGKNa+Z33p3RFeBD4Hoqe2XaaKvGfDLprZ3FUhKOJEjFMi9kfMbbs57L4CzqYGr2Xyg==}
+  '@prisma/composer@0.14.0':
+    resolution: {integrity: sha512-XRXadDM5+zpEDZIW602asV7YFfwbC+BU2cWLXQw0l1QddOTlvSquvZKB20n8Sg9x1pRm279Pmo0eGuB0I/VLPg==}
     engines: {node: '>=22.18.0'}
 
   '@prisma/compute-sdk@0.39.0':
@@ -1364,18 +1364,18 @@ packages:
   '@prisma/management-api-sdk@1.62.0':
     resolution: {integrity: sha512-XJjNcsMEmvXA2vE88cBSwCQBKiWx3ArGQ00MIFePP653ZdY0Uiaodoyw++WnwewvHqOvpzgSC3XsijjRUuveHQ==}
 
-  '@prisma/orm-framework@8.0.0-rc.6':
-    resolution: {integrity: sha512-EQAHOHr66mH4tFnSrx/8b2QLbuhGfFu5I+lXFoKzGmMJuVZnVDoy/354huMsOjEXPQykgRo0qNl7tY8eTrwlug==}
+  '@prisma/orm-framework@8.0.0-rc.7':
+    resolution: {integrity: sha512-yl3giEt14nuHkxBQjXlzfstXdYxQPjbnJJ9lyA+5oNRgqIPdwwJiEUUxhASnAyhfrENZMJhtiwSqJPPxCGp4+A==}
     peerDependencies:
       typescript: '>=5.9'
     peerDependenciesMeta:
       typescript:
         optional: true
 
-  '@prisma/orm-toolchain@8.0.0-rc.6':
-    resolution: {integrity: sha512-Pv7JkxpFLs7Fa0i6oCPbClSQ704/WGQZfhk6Tia4BZHwWSnN6h1q9NlKkJMfIlFCUM/XdLDpIAQlc3Aeh4oXhQ==}
+  '@prisma/orm-toolchain@8.0.0-rc.7':
+    resolution: {integrity: sha512-BLmdSGzFmmTt3yXWbACODsPn7chSEfqGPdwL8C4CHWb0S0QFzKMY48Ygc5Mhmcj/h0pthhr6CeRr/unKOgSsuw==}
     peerDependencies:
-      '@prisma/cli-engine': 0.2.2
+      '@prisma/cli-engine': 0.2.3
       typescript: '>=5.9'
       vite: ^7.0.0 || ^8.0.0
     peerDependenciesMeta:
@@ -4378,10 +4378,10 @@ snapshots:
 
   '@oxc-project/types@0.139.0': {}
 
-  '@prisma/composer-cli@0.13.0(@prisma/cli-engine@packages+cli-engine)(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)':
+  '@prisma/composer-cli@0.14.0(@prisma/cli-engine@packages+cli-engine)(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)':
     dependencies:
       '@prisma/cli-engine': link:packages/cli-engine
-      '@prisma/composer': 0.13.0(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
+      '@prisma/composer': 0.14.0(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
       alchemy: 2.0.0-beta.74(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(effect@4.0.0-rc.111)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)
       c12: 3.3.4(magicast@0.5.3)
       effect: 4.0.0-rc.111
@@ -4411,7 +4411,7 @@ snapshots:
       - vitest
       - ws
 
-  '@prisma/composer@0.13.0(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)':
+  '@prisma/composer@0.14.0(@types/node@22.19.19)(@vercel/nft@1.10.2(rollup@4.62.2))(magicast@0.5.3)(mongodb@6.21.0(@aws-sdk/credential-providers@3.1107.0))(mysql2@3.23.3(@types/node@22.19.19))(pg@8.23.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))(vitest@4.1.8(@types/node@22.19.19)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)))(ws@8.21.0)':
     dependencies:
       '@prisma/management-api-sdk': 1.62.0
       '@standard-schema/spec': 1.1.0
@@ -4507,7 +4507,7 @@ snapshots:
     dependencies:
       openapi-fetch: 0.14.0
 
-  '@prisma/orm-framework@8.0.0-rc.6(typescript@6.0.3)':
+  '@prisma/orm-framework@8.0.0-rc.7(typescript@6.0.3)':
     dependencies:
       '@standard-schema/spec': 1.1.0
       arktype: 2.2.3
@@ -4516,10 +4516,10 @@ snapshots:
     optionalDependencies:
       typescript: 6.0.3
 
-  '@prisma/orm-toolchain@8.0.0-rc.6(@prisma/cli-engine@packages+cli-engine)(magicast@0.5.3)(typanion@3.14.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))':
+  '@prisma/orm-toolchain@8.0.0-rc.7(@prisma/cli-engine@packages+cli-engine)(magicast@0.5.3)(typanion@3.14.0)(typescript@6.0.3)(vite@7.3.5(@types/node@22.19.19)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))':
     dependencies:
       '@prisma/cli-engine': link:packages/cli-engine
-      '@prisma/orm-framework': 8.0.0-rc.6(typescript@6.0.3)
+      '@prisma/orm-framework': 8.0.0-rc.7(typescript@6.0.3)
       '@vercel/detect-agent': 1.2.4
       arktype: 2.2.3
       c12: 3.3.4(magicast@0.5.3)
diff --git a/scripts/cutover-dist-tags.sh b/scripts/cutover-dist-tags.sh
new file mode 100644
index 00000000..14b0a473
--- /dev/null
+++ b/scripts/cutover-dist-tags.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# One-shot registry maintenance for the latest-tag cutover
+# (rollout-plan step 5). Everything here needs real npm auth, which the
+# publish workflow's OIDC cannot provide: OIDC authenticates publishes,
+# and these commands touch already-published versions.
+#
+# Usage:
+#   export NPM_TOKEN=...   # an automation token, so no 2FA prompt
+#   bash scripts/cutover-dist-tags.sh
+#
+# The token is read from the environment and never echoed.
+
+set -euo pipefail
+
+if [ -z "${NPM_TOKEN:-}" ]; then
+  echo "NPM_TOKEN is not set. Export it first (an npm automation token)." >&2
+  exit 1
+fi
+
+npmrc=$(mktemp)
+trap 'rm -f "$npmrc"' EXIT
+echo "//registry.npmjs.org/:_authToken=\${NPM_TOKEN}" > "$npmrc"
+
+run() {
+  echo "+ $*"
+  NPM_CONFIG_USERCONFIG="$npmrc" "$@"
+}
+
+# The engine's tags went stale because publish-packages.sh tolerates an
+# already-published version by skipping it, which also skips the tag
+# move. Point latest at the newest published engine and drop its stale
+# next tag: since the cutover, releases publish under latest only and
+# next is retired (docs/oss/versioning.md).
+run npm dist-tag add @prisma/cli-engine@0.2.3 latest
+run npm dist-tag rm @prisma/cli-engine next
+
+# next froze at the last pre-cutover RC on the CLI names. Remove it so
+# prisma@next stops resolving an ever-older release; text that says
+# prisma@next should move to plain prisma.
+run npm dist-tag rm prisma next
+run npm dist-tag rm @prisma/cli next
+
+# Deprecations from the rollout plan, step 5:
+#   prisma-next    — already deprecated (operator, 2026-08-24).
+#   prisma-composer — left alone (operator ruling, 2026-08-25).
+#   @prisma/cli    — undecided: this repo still publishes it as the
+#                    scoped twin of the bare name. Uncomment to point
+#                    installers at `prisma` instead:
+# run npm deprecate @prisma/cli@"<8.0.0" "The unified Prisma CLI ships as 'prisma'. Install prisma instead."
+
+echo "Done."
diff --git a/scripts/determine-version-utils.test.ts b/scripts/determine-version-utils.test.ts
index be6159b0..93b595a6 100644
--- a/scripts/determine-version-utils.test.ts
+++ b/scripts/determine-version-utils.test.ts
@@ -142,9 +142,9 @@ describe("assertCanonicalBase", () => {
 });
 
 describe("releaseDistTag", () => {
-  it("sends an RC-line bump to next, so latest stays put until the deliberate flip", () => {
-    assert.equal(releaseDistTag("8.0.0-rc.1"), "next");
-    assert.equal(releaseDistTag("8.0.0-rc.12"), "next");
+  it("sends an RC-line bump to latest — the cutover ruling of 2026-08-25", () => {
+    assert.equal(releaseDistTag("8.0.0-rc.1"), "latest");
+    assert.equal(releaseDistTag("8.0.0-rc.12"), "latest");
   });
 
   it("sends a stable bump to latest", () => {
@@ -180,13 +180,13 @@ describe("isReleasePublish", () => {
   });
 
   it("a publish under the base's canonical tag is a release", () => {
-    assert.equal(isReleasePublish("8.0.0-rc.2", "next"), true);
+    assert.equal(isReleasePublish("8.0.0-rc.2", "latest"), true);
     assert.equal(isReleasePublish("8.1.0", "latest"), true);
   });
 
   it("a beta or off-tag publish is not a release", () => {
     assert.equal(isReleasePublish("8.0.0-rc.2", "beta"), false);
-    assert.equal(isReleasePublish("8.0.0-rc.2", "latest"), false);
+    assert.equal(isReleasePublish("8.0.0-rc.2", "next"), false);
   });
 });
 
diff --git a/scripts/determine-version-utils.ts b/scripts/determine-version-utils.ts
index 11681ac1..cac4255c 100644
--- a/scripts/determine-version-utils.ts
+++ b/scripts/determine-version-utils.ts
@@ -118,15 +118,19 @@ export function assertValidDistTag(tag: string): void {
 }
 
 /**
- * The dist-tag a release-bump push publishes under. RC-line versions go
- * to `next`: `latest` keeps serving the pre-8 CLI until the operator
- * deliberately moves it (rollout plan step 5), by dispatching the
- * publish workflow with `dist-tag: latest` or by widening this rule
- * when the RC line is ready. Stable versions go to `latest`.
+ * The dist-tag a release-bump push publishes under: `latest`, on the
+ * RC line included. This is the rollout plan's step-5 cutover, ruled by
+ * the operator on 2026-08-25: `npm install prisma` serves the unified
+ * v8 CLI from the first release after this widening. Before it, RC
+ * releases went to `next` while `latest` kept serving the pre-8 CLI.
+ * `next` is not moved by the publish path anymore: it froze at the
+ * last pre-cutover RC, and the operator re-points or retires it by
+ * hand — npm has no token permission narrower than package write, so
+ * an automated sync would mean a standing publish-capable token.
  */
 export function releaseDistTag(base: string): "latest" | "next" {
   assertCanonicalBase(base);
-  return base.includes("-rc.") ? "next" : "latest";
+  return "latest";
 }
 
 /**