diff --git a/.sbx/kits/hugo/spec.yaml b/.sbx/kits/hugo/spec.yaml
new file mode 100644
index 00000000000..815ddac9f7d
--- /dev/null
+++ b/.sbx/kits/hugo/spec.yaml
@@ -0,0 +1,52 @@
+schemaVersion: "2"
+kind: mixin
+name: hugo
+displayName: Hugo
+description: Installs the Hugo Extended static site generator from a pinned GitHub release.
+
+permissions:
+  network:
+    allow:
+      # Release tarball download (install time, one-shot).
+      # github.com 302-redirects to release-assets.githubusercontent.com for binary downloads.
+      - github.com
+      - release-assets.githubusercontent.com
+
+setup:
+  install:
+    - command: |
+        set -euo pipefail
+        # Keep in sync with ARG HUGO_VERSION in this repo's Dockerfile.
+        HUGO_VERSION=0.163.0
+        ARCH=$(dpkg --print-architecture)
+        case "$ARCH" in
+          amd64)
+            TARBALL="hugo_extended_${HUGO_VERSION}_Linux-64bit.tar.gz"
+            SHA256="6291775b7d012f9b10fb377ba914e5b1589c0b0d2531b695fa9029be14750111"
+            ;;
+          arm64)
+            TARBALL="hugo_extended_${HUGO_VERSION}_linux-arm64.tar.gz"
+            SHA256="ed50d3ec8c5b427013137e38718a5d398a90956ce9e3a8a3cb7ebf3fdd01072b"
+            ;;
+          *)
+            echo "unsupported arch: $ARCH" >&2
+            exit 1
+            ;;
+        esac
+        curl --proto '=https' --tlsv1.2 -fsSL \
+          -o /tmp/hugo.tgz \
+          "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${TARBALL}"
+        echo "${SHA256}  /tmp/hugo.tgz" | sha256sum -c -
+        tar -C /usr/local/bin -xzf /tmp/hugo.tgz hugo
+        rm /tmp/hugo.tgz
+        hugo version
+      user: "0"
+      description: "Install pinned Hugo Extended CLI"
+
+agentInstructions:
+  content: |
+    ## Hugo static site generator
+
+    The `hugo` CLI (extended edition, v0.163.0) is installed and available on
+    `PATH`. This repository builds https://docs.docker.com/ with Hugo. Run
+    `hugo version` to confirm, and `hugo server` to preview the site locally.
diff --git a/.sbx/kits/rumdl/spec.yaml b/.sbx/kits/rumdl/spec.yaml
new file mode 100644
index 00000000000..dfda7f855b8
--- /dev/null
+++ b/.sbx/kits/rumdl/spec.yaml
@@ -0,0 +1,52 @@
+schemaVersion: "2"
+kind: mixin
+name: rumdl
+displayName: rumdl
+description: Installs the rumdl Markdown linter/formatter from a pinned GitHub release, matching the version this repository uses.
+
+permissions:
+  network:
+    allow:
+      # Release tarball download (install time, one-shot).
+      # github.com 302-redirects to release-assets.githubusercontent.com for binary downloads.
+      - github.com
+      - release-assets.githubusercontent.com
+
+setup:
+  install:
+    - command: |
+        set -euo pipefail
+        # Keep in sync with the "rumdl" devDependency version in this repo's package.json.
+        RUMDL_VERSION=0.2.49
+        ARCH=$(dpkg --print-architecture)
+        case "$ARCH" in
+          amd64)
+            TARBALL="rumdl-v${RUMDL_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+            SHA256="e208db27143592a18b26d9d42e6e76133a2dcdb8738d2ed0f8d3b44027b2d8d6"
+            ;;
+          arm64)
+            TARBALL="rumdl-v${RUMDL_VERSION}-aarch64-unknown-linux-gnu.tar.gz"
+            SHA256="b57cfdc83f4bbe0714c4a7642464107a5c64f258d5925d67bc9b3816dbe0701a"
+            ;;
+          *)
+            echo "unsupported arch: $ARCH" >&2
+            exit 1
+            ;;
+        esac
+        curl --proto '=https' --tlsv1.2 -fsSL \
+          -o /tmp/rumdl.tgz \
+          "https://github.com/rvben/rumdl/releases/download/v${RUMDL_VERSION}/${TARBALL}"
+        echo "${SHA256}  /tmp/rumdl.tgz" | sha256sum -c -
+        tar -C /usr/local/bin -xzf /tmp/rumdl.tgz rumdl
+        rm /tmp/rumdl.tgz
+        rumdl --version
+      user: "0"
+      description: "Install pinned rumdl CLI"
+
+agentInstructions:
+  content: |
+    ## rumdl Markdown linter
+
+    The `rumdl` CLI is installed and available on `PATH`. Format a Markdown
+    file with `rumdl fmt <file>` and lint it with `rumdl check <file>` (or
+    the project's `scripts/lint.sh <file>...`, which also runs Vale).
diff --git a/.sbxenv.yaml b/.sbxenv.yaml
new file mode 100644
index 00000000000..9ec8b8ea692
--- /dev/null
+++ b/.sbxenv.yaml
@@ -0,0 +1,22 @@
+schemaVersion: "1"
+name: docs-env
+agent: codex
+
+workspace:
+  path: $HOME/src/github.com/docker/docs
+  clone: true
+
+kits:
+  - "git+https://github.com/docker/sbx-kits-contrib.git#dir=vale"
+  - "git+https://github.com/docker/sbx-kits-contrib.git#dir=git-ssh-sign"
+  - "git+https://github.com/docker/sbx-kits-contrib.git#dir=github-ssh"
+  - "./.sbx/kits/hugo"
+  - "./.sbx/kits/rumdl"
+
+secrets:
+  github:
+    command: gh auth token
+
+ports:
+  - sandbox: 1313
+    host: 1313