diff --git a/.envrc b/.envrc
index 606bb15..58e53d0 100644
--- a/.envrc
+++ b/.envrc
@@ -1,10 +1,32 @@
 export PATH="$(git rev-parse --show-toplevel)/bin:$PATH"
 
-arch=$(uname | tr A-Z a-z)
+err() {
+    >&2 echo "$*"
+    exit 1
+}
 
-if [[ ! -x bin/bazel ]]; then
-    mkdir -p bin
-    wget "https://github.com/bazelbuild/bazelisk/releases/download/v1.9.0/bazelisk-${arch}-amd64" \
-        -O bin/bazel
-    chmod a+x bin/bazel
+goos=$(uname | tr A-Z a-z)
+
+case $(uname -m) in
+    x86_64) goarch=amd64;;
+    aarch64) goarch=arm64;;
+    *) err "unsupported architecture $(uname -m)"
+esac
+
+if [[ -x bin/bazel ]]; then
+    exit
 fi
+
+rm -f "bin/bazelisk-${goos}-${goarch}"
+wget --no-verbose "https://github.com/bazelbuild/bazelisk/releases/download/v1.10.1/bazelisk-${goos}-${goarch}" \
+    -O "bin/bazelisk-${goos}-${goarch}"
+
+sha256sum -c --ignore-missing <<-EOF
+e485bbf84532d02a60b0eb23c702610b5408df3a199087a4f2b5e0995bbf2d5a  bin/bazelisk-darwin-amd64
+c22d48601466d9d3b043ccd74051f2f4230f9b9f4509f097017c97303aa88d13  bin/bazelisk-darwin-arm64
+4cb534c52cdd47a6223d4596d530e7c9c785438ab3b0a49ff347e991c210b2cd  bin/bazelisk-linux-amd64
+c1de6860dd4f8d5e2ec270097bd46d6a211b971a0b8b38559784bd051ea950a1  bin/bazelisk-linux-arm64
+EOF
+
+chmod a+x "bin/bazelisk-${goos}-${goarch}"
+mv "bin/bazelisk-${goos}-${goarch}" bin/bazel
diff --git a/.gitignore b/.gitignore
index 0f810e9..976e119 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 *.sw[op]
 
 /bin/bazel
+/bin/bazelisk-*
 
 /bazel-bazel-zig-cc
 /bazel-bin