diff --git a/.dagger/modules/e2e/main.dang b/.dagger/modules/e2e/main.dang
index d07ad16..c7ed65a 100644
--- a/.dagger/modules/e2e/main.dang
+++ b/.dagger/modules/e2e/main.dang
@@ -245,6 +245,27 @@ type E2e {
     null
   }
 
+  """Git pins follow lock, and JSON is removed in both modes."""
+  pub generateScopePinsCheck(ws: Workspace!): Void @check {
+    let commit = "64645f1967d3dba6fce951dd61ae4acd8d9b0861"
+    let target = moduleSource("github.com/dagger/sdk-helpers@main", refPin: commit)
+    let input = ws.withWorkdir(tomlGenerateModulePath).withNewFile("keep.txt", "keep")
+    let unlocked = pythonSdk.generateScope(input, isModule: true, name: "toml-generate-app", clients: [target])
+    assertNotContains(unlocked.file("dagger-module.toml").contents, "pin =", "default output contains a pin")
+    assertContains(unlocked.file("dagger-module.toml").contents, target.asString, "Git source changed")
+    let locked = pythonSdk(lock: true).generateScope(unlocked, isModule: true, name: "toml-generate-app", clients: [target])
+    assertContains(locked.file("dagger-module.toml").contents, "pin = \"" + commit + "\"", "selected commit was lost")
+    let unlockedAgain = pythonSdk.generateScope(locked.withNewFile("dagger.json", "stale"), isModule: true, name: "toml-generate-app", clients: [target])
+    assertNotContains(unlockedAgain.file("dagger-module.toml").contents, "pin =", "disabling lock retained a pin")
+    assert(!unlockedAgain.directory(".").exists("dagger.json"), "generation retained JSON")
+    assert(unlockedAgain.cwd == input.cwd, "generation changed cwd")
+    assert(unlockedAgain.file("keep.txt").contents == "keep", "generation changed another file")
+    assertContains(unlockedAgain.file("dagger-module.toml").contents, "engineVersion = \"v1.0.0-0\"", "generation changed the engine version")
+    let repeated = pythonSdk.generateScope(unlockedAgain, isModule: true, name: "toml-generate-app", clients: [target])
+    assert(repeated.changes(unlockedAgain).isEmpty, "repeated generation changed the workspace")
+    null
+  }
+
   """
   Generation reports only what it produced: dagger.json and the committed
   .gitattributes are already on disk, so a changeset adding either describes
diff --git a/.dagger/modules/engine-e2e/dagger-module.toml b/.dagger/modules/engine-e2e/dagger-module.toml
index ed140a7..bc5fffb 100644
--- a/.dagger/modules/engine-e2e/dagger-module.toml
+++ b/.dagger/modules/engine-e2e/dagger-module.toml
@@ -6,4 +6,4 @@ engineVersion = "v1.0.0-0"
 
 [[dependencies]]
   name = "engine-dev"
-  source = "github.com/dagger/dagger/.dagger/modules/engine-dev@8fd9b22b5416f8dc7cb420ba37769adef6e874d2"
+  source = "github.com/dagger/dagger/.dagger/modules/engine-dev@0d031c08ef3e379c6f4eb7f8f5cad4638a168863"
diff --git a/.dagger/modules/engine-e2e/main.dang b/.dagger/modules/engine-e2e/main.dang
index c815f4f..94938cb 100644
--- a/.dagger/modules/engine-e2e/main.dang
+++ b/.dagger/modules/engine-e2e/main.dang
@@ -1,10 +1,9 @@
 """
-Checks the Python SDK against an engine built from dagger/dagger#13992
-(branch sdk-ux-module-max), at the commit engine-dev is pinned to in
-dagger-module.toml.
+Checks the Python SDK against a pinned main engine.
+Keep engineCommit and the engine-dev dependency in dagger-module.toml aligned.
 """
 type EngineE2e {
-  let engineCommit: String! = "8fd9b22b5416f8dc7cb420ba37769adef6e874d2"
+  let engineCommit: String! = "0d031c08ef3e379c6f4eb7f8f5cad4638a168863"
   let modulePath: String! = ".dagger/modules/sdk-smoke"
 
   let assert(condition: Boolean!, message: String!): Void {
@@ -15,11 +14,12 @@ type EngineE2e {
   }
 
   """
-  The module-max engine should list this checkout as the python SDK,
+  The pinned main engine should list this checkout as the python SDK,
   initialize a Python module from it, and run the module.
   """
   pub devSdkCheck(ws: Workspace!): Void @check {
     let sdkSource = ws.directory("/", exclude: [".git", ".remember", "**/.venv", "**/__pycache__", ".dagger/modules/e2e/out"])
+      .withFile("dagger.toml", ws.file("/.dagger/modules/engine-e2e/workspace.toml"))
     let engineSource = git("https://github.com/dagger/dagger")
       .ref(engineCommit)
       .asWorkspace
@@ -32,7 +32,7 @@ type EngineE2e {
     let listed = client.withExec(["dagger", "sdk", "list"])
     assert(listed.stdout.contains("python"), "the development Python SDK was not listed")
 
-    let checked = listed.withExec(["dagger", "-m", ".dagger/modules/e2e", "check"])
+    let checked = listed.withExec(["dagger", "check"])
 
     let initialized = checked
       .withExec(["dagger", "module", "init", "python", "--auto-apply", "--name", "sdk-smoke", "--path", modulePath])
diff --git a/.dagger/modules/engine-e2e/workspace.toml b/.dagger/modules/engine-e2e/workspace.toml
new file mode 100644
index 0000000..063324d
--- /dev/null
+++ b/.dagger/modules/engine-e2e/workspace.toml
@@ -0,0 +1,42 @@
+# Dagger workspace configuration
+# Install modules with: dagger module install <module>
+# Example:
+#   dagger module install github.com/dagger/dagger/modules/wolfi
+
+[modules.e2e]
+source = ".dagger/modules/e2e"
+
+[modules.python-sdk]
+source = "."
+check.skip = ["*"]
+
+[sdks.python]
+module = "python-sdk"
+
+[sdks.python.scopes.".dagger/modules/e2e/fixtures/generate/app"]
+is-module = true
+name = "generate-app"
+
+[sdks.python.scopes.".dagger/modules/e2e/fixtures/lookup/app"]
+is-module = true
+name = "lookup-app"
+
+[sdks.python.scopes.".dagger/modules/e2e/fixtures/toml/app"]
+is-module = true
+name = "toml-app"
+
+[sdks.python.scopes.".dagger/modules/e2e/fixtures/mixed-discovery/ancestor/work/app"]
+is-module = true
+name = "mixed-discovery-app"
+
+[sdks.python.scopes.".dagger/modules/e2e/fixtures/config/app"]
+is-module = true
+name = "config-app"
+
+[sdks.python.scopes.".dagger/modules/e2e/fixtures/config/configured"]
+is-module = true
+name = "config-configured"
+
+[sdks.python.scopes.".dagger/modules/e2e/fixtures/toml-generate/app"]
+is-module = true
+name = "toml-generate-app"
diff --git a/dagger-module.toml b/dagger-module.toml
new file mode 100644
index 0000000..d073573
--- /dev/null
+++ b/dagger-module.toml
@@ -0,0 +1,10 @@
+name = "python-sdk"
+engineVersion = "v1.0.0-beta.11"
+include = ["!runtime", "!.dagger", "!future", "!docs"]
+
+[runtime]
+source = "dang"
+
+[[dependencies]]
+name = "sdk-helpers"
+source = "dagger.io/sdk/helpers@v1"
diff --git a/dagger.json b/dagger.json
index 85e3ff6..92bc692 100644
--- a/dagger.json
+++ b/dagger.json
@@ -13,7 +13,7 @@
   "dependencies": [
     {
       "name": "sdk-helpers",
-      "source": "github.com/dagger/sdk-helpers"
+      "source": "dagger.io/sdk/helpers@v1"
     }
   ]
 }
diff --git a/dagger.lock b/dagger.lock
index 82f5e80..943ac54 100644
--- a/dagger.lock
+++ b/dagger.lock
@@ -1,8 +1,9 @@
 [["version","2"]]
-["","git-latest",["https://github.com/dagger/sdk-helpers"],"refs/heads/main"]
+["","git-latest",["github.com/dagger/sdk-helpers"],"refs/tags/v1.0.1",[["version","v1"]]]
 ["","git-latest",["https://github.com/dagger/sdk-sdk"],"refs/heads/main"]
+["","git-sha",["github.com/dagger/sdk-helpers","refs/tags/v1.0.1"],"d2780115934d74f4bdd1ff4396ba70ba1195507d"]
 ["","git-sha",["https://github.com/containernetworking/plugins","refs/tags/v1.9.0"],"9b3772e1a7abf93cbb7c6526a28bc0d27b830e02"]
-["","git-sha",["https://github.com/dagger/sdk-helpers","refs/heads/main"],"64645f1967d3dba6fce951dd61ae4acd8d9b0861"]
+["","git-sha",["https://github.com/dagger/sdk-helpers","main"],"64645f1967d3dba6fce951dd61ae4acd8d9b0861"]
 ["","git-sha",["https://github.com/dagger/sdk-sdk","refs/heads/main"],"334448911a8292fba0d677e5f31926c79ad80ad3"]
 ["","git-sha",["https://github.com/libfuse/sshfs.git","refs/tags/sshfs-3.7.6"],"7a2d988775446ebe7af9b01c99b3b8e86bddb05a"]
 ["","git-sha",["https://github.com/opencontainers/runc","refs/tags/v1.4.2"],"c241c0bb5e60a8e8c1b2e53d4eca8d0068d8d57e"]
@@ -12,4 +13,5 @@
 ["","oci-sha",["docker.io/library/golang:1.25-alpine"],"sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59"]
 ["","oci-sha",["docker.io/library/golang:1.26-alpine"],"sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628"]
 ["","oci-sha",["docker.io/tonistiigi/xx:1.2.1"],"sha256:8879a398dedf0aadaacfbd332b29ff2f84bc39ae6d4e9c0a1109db27ac5ba012"]
-["","oci-sha",["ghcr.io/astral-sh/uv:python3.14-alpine"],"sha256:706cd9faf6d3fa7476fc470463bfca625d4b3ea5e46d6dc166ec1fb8ad3976e6"]
\ No newline at end of file
+["","oci-sha",["ghcr.io/astral-sh/uv:python3.14-alpine"],"sha256:706cd9faf6d3fa7476fc470463bfca625d4b3ea5e46d6dc166ec1fb8ad3976e6"]
+["","vanity-url",["https://dagger.io/sdk/helpers"],"https://github.com/dagger/sdk-helpers"]
\ No newline at end of file
diff --git a/dagger.toml b/dagger.toml
index 632e040..2eec7e7 100644
--- a/dagger.toml
+++ b/dagger.toml
@@ -1,42 +1,4 @@
-# Dagger workspace configuration
-# Install modules with: dagger module install <module>
-# Example:
-#   dagger module install github.com/dagger/dagger/modules/wolfi
+# Run SDK checks inside the development engine.
 
 [modules.engine-e2e]
 source = ".dagger/modules/engine-e2e"
-
-[modules.python-sdk]
-source = "."
-check.skip = ["*"]
-
-[sdks.python]
-module = "python-sdk"
-
-[sdks.python.scopes.".dagger/modules/e2e/fixtures/generate/app"]
-is-module = true
-name = "generate-app"
-
-[sdks.python.scopes.".dagger/modules/e2e/fixtures/lookup/app"]
-is-module = true
-name = "lookup-app"
-
-[sdks.python.scopes.".dagger/modules/e2e/fixtures/toml/app"]
-is-module = true
-name = "toml-app"
-
-[sdks.python.scopes.".dagger/modules/e2e/fixtures/mixed-discovery/ancestor/work/app"]
-is-module = true
-name = "mixed-discovery-app"
-
-[sdks.python.scopes.".dagger/modules/e2e/fixtures/config/app"]
-is-module = true
-name = "config-app"
-
-[sdks.python.scopes.".dagger/modules/e2e/fixtures/config/configured"]
-is-module = true
-name = "config-configured"
-
-[sdks.python.scopes.".dagger/modules/e2e/fixtures/toml-generate/app"]
-is-module = true
-name = "toml-generate-app"
diff --git a/python-sdk.dang b/python-sdk.dang
index e1b5d70..9aa650b 100644
--- a/python-sdk.dang
+++ b/python-sdk.dang
@@ -7,6 +7,9 @@ type PythonSdk {
   """
   pub template: String! = "default"
 
+  """Write selected Git commits as manifest pins."""
+  pub lock: Boolean! = false
+
   """
   Python version written to a new module's pyproject.toml; empty keeps the template's.
   """
@@ -119,38 +122,9 @@ type PythonSdk {
     } else {
       sdkHelpers.moduleManifest.withLegacyPythonRuntime
     }
-    let configured = clients.{{moduleName, kind, sourceRootSubpath, asString, pin}}
-      .reduce(base.withName(name: name).withoutLegacyRuntimeDependencies) { manifest, client =>
-        manifest.withLegacyRuntimeDependency(
-          source: dependencySource(scope, client.kind, client.sourceRootSubpath, client.asString),
-          name: client.moduleName,
-          pin: client.pin,
-        )
-      }
-    let generated = ws.withFile(root + "/dagger-module.toml", configured.tomlFile)
-
-    if (hasJson) {
-      generated.withoutFile(root + "/dagger.json")
-    } else {
-      generated
-    }
-  }
-
-  """
-  The dependency source a client is recorded as: a git ref as is, a local
-  module by its path relative to the module.
-  """
-  let dependencySource(scope: String!, kind: ModuleSourceKind!, sourceRootSubpath: String!, ref: String!): String! {
-    if (kind == ModuleSourceKind.GIT_SOURCE) {
-      ref
-    } else {
-      let relative = Path(normalizePath(sourceRootSubpath)).relativeTo(Path(scope))
-      if (relative == null) {
-        raise "cannot resolve client module path " + sourceRootSubpath + " from scope " + scope
-      } else {
-        relative.string
-      }
-    }
+    clients.reduce(base.withName(name: name).withoutLegacyRuntimeDependencies) { manifest, client =>
+      manifest.withLegacyRuntimeDependency(module: client)
+    }.generate(ws.withWorkdir(scope), lock: lock, legacyJson: false).withWorkdir(".")
   }
 
   """