diff --git a/scripts/smoke_generated_web.sh b/scripts/smoke_generated_web.sh
index 6ced71b..adce84e 100755
--- a/scripts/smoke_generated_web.sh
+++ b/scripts/smoke_generated_web.sh
@@ -9,6 +9,17 @@ fi
 cli_path="$1"
 framework_commit="${2:-}"
 framework_repository="${3:-amberframework/amber}"
+if command -v shards-alpha >/dev/null 2>&1; then
+  shards_command="shards-alpha"
+else
+  shards_command="shards"
+fi
+if command -v crystal-alpha >/dev/null 2>&1; then
+  crystal_command="crystal-alpha"
+else
+  crystal_command="crystal"
+fi
+echo "Using dependency installer: $shards_command"
 script_dir="$(cd "$(dirname "$0")" && pwd)"
 if [[ "$cli_path" != /* ]]; then
   cli_path="$(cd "$(dirname "$cli_path")" && pwd)/$(basename "$cli_path")"
@@ -28,13 +39,23 @@ cleanup() {
 trap cleanup EXIT
 
 "$cli_path" --version | grep -E "Amber CLI v2\.0\.[0-9]+"
-"$cli_path" new "$app_path" --type web --no-deps
+"$cli_path" new "$app_path" --type web
+test -s "$app_path/shard.lock"
+
+grep -F 'shards install' "$app_path/README.md"
+grep -F 'crystal spec' "$app_path/README.md"
+grep -F '`shards-alpha install` writes a checksum-verified `shard.lock` when `shards-alpha` is installed; commit the lock with the application.' "$app_path/README.md"
+test "$(grep -cF '`shards-alpha install` writes a checksum-verified `shard.lock` when `shards-alpha` is installed; commit the lock with the application.' "$app_path/README.md")" -eq 1
+! grep -F 'crystal-alpha' "$app_path/.amber.yml"
+grep -F 'AMBER_ENV=test crystal spec' "$script_dir/../src/amber_cli/templates/app/.amber.yml.ecr"
+! grep -F 'crystal-alpha' "$script_dir/../src/amber_cli/templates/app/.amber.yml.ecr"
 
 grep -F "github: amberframework/amber" "$app_path/shard.yml"
 grep -F "version: 2.0.0-beta.5" "$app_path/shard.yml"
 grep -F "github: crimson-knight/grant" "$app_path/shard.yml"
 grep -F "github: amberframework/asset_pipeline" "$app_path/shard.yml"
 grep -F "version: ~> 0.37.0" "$app_path/shard.yml"
+grep -F "commit: 70ac8beaa172f03c389bacaff06cd8f3c520805c" "$app_path/shard.yml"
 grep -F "github: crystal-lang/crystal-sqlite3" "$app_path/shard.yml"
 grep -F "template: ecr" "$app_path/.amber.yml"
 grep -F "database: sqlite" "$app_path/.amber.yml"
@@ -57,14 +78,28 @@ if [[ -n "$framework_commit" ]]; then
 fi
 
 cd "$app_path"
+test -s shard.lock
+! grep -F "shard.lock" .gitignore
 "$cli_path" assets check
 env GIT_CONFIG_COUNT=1 \
   GIT_CONFIG_KEY_0=core.hooksPath \
   GIT_CONFIG_VALUE_0=/dev/null \
-  shards install
+  "$shards_command" install
+test -s shard.lock
+grep -F "version: 0.23.4+git.commit.70ac8beaa172f03c389bacaff06cd8f3c520805c" shard.lock
+grep -F "version: 0.14.0" shard.lock
+if [[ "$shards_command" == "shards-alpha" ]]; then
+  grep -F "checksum: sha256:f416f65a7b19d54047d345b8a94b2b1c9bf434985849e1aed2a446135bce7ba9" shard.lock
+  grep -F "checksum: sha256:4a4dea15c27b985cd9d8c5c545024daafab347b56986252fd24fcc3f18e5c024" shard.lock
+  shard_count="$(grep -cE '^  [[:alnum:]_-]+:$' shard.lock)"
+  checksum_count="$(grep -cE '^    checksum: sha256:[0-9a-f]{64}$' shard.lock)"
+  test "$checksum_count" -eq "$shard_count"
+else
+  echo "shards-alpha unavailable; checksum lock assertions skipped" >&2
+fi
 "$cli_path" assets build
 "$cli_path" assets check
-crystal spec
+"$crystal_command" spec
 
 "$cli_path" generate scaffold Pet name:string:required species:string:required adopted:bool
 "$cli_path" generate job PublishPost --queue=default
@@ -96,13 +131,13 @@ if find src spec -iname '*slang*' -print | grep -q .; then
   echo "a core generator emitted a Slang file" >&2
   exit 1
 fi
-crystal tool format --check src spec
-crystal spec
+"$crystal_command" tool format --check src spec
+"$crystal_command" spec
 "$cli_path" assets build
 "$cli_path" assets check
-crystal build src/amber_beta_smoke.cr -o bin/amber_beta_smoke
+"$crystal_command" build src/amber_beta_smoke.cr -o bin/amber_beta_smoke
 
-asset_paths="$(crystal run "$script_dir/read_asset_paths.cr" -- \
+asset_paths="$("$crystal_command" run "$script_dir/read_asset_paths.cr" -- \
   public/assets/manifest.json \
   stylesheets/app.css \
   javascript/app.js \
diff --git a/spec/commands/new_command_spec.cr b/spec/commands/new_command_spec.cr
index d68c6ae..9c3d6d7 100644
--- a/spec/commands/new_command_spec.cr
+++ b/spec/commands/new_command_spec.cr
@@ -2,6 +2,29 @@ require "../amber_cli_spec"
 require "../../src/amber_cli/commands/new"
 
 describe AmberCLI::Commands::NewCommand do
+  describe ".find_shards_executable" do
+    it "prefers shards-alpha when it is available" do
+      executable = AmberCLI::Commands::NewCommand.find_shards_executable(
+        ->(command : String) { command == "shards-alpha" ? "/tools/shards-alpha" : "/tools/shards" }
+      )
+
+      executable.should eq("/tools/shards-alpha")
+    end
+
+    it "falls back to shards when shards-alpha is unavailable" do
+      lookup_calls = [] of String
+      executable = AmberCLI::Commands::NewCommand.find_shards_executable(
+        ->(command : String) do
+          lookup_calls << command
+          command == "shards" ? "/tools/shards" : nil
+        end
+      )
+
+      executable.should eq("/tools/shards")
+      lookup_calls.should eq(["shards-alpha", "shards"])
+    end
+  end
+
   describe "#setup_command_options" do
     it "accepts --type web (default)" do
       command = AmberCLI::Commands::NewCommand.new("new")
@@ -89,11 +112,23 @@ describe AmberCLI::Commands::NewCommand do
         shard.should contain("version: 2.0.0-beta.5")
         shard.should contain("grant:")
         shard.should contain("github: crimson-knight/grant")
+        shard.should contain("commit: 70ac8beaa172f03c389bacaff06cd8f3c520805c")
         shard.should contain("asset_pipeline:")
         shard.should contain("github: amberframework/asset_pipeline")
         shard.should contain("github: crystal-lang/crystal-sqlite3")
         shard.should_not contain("slang")
 
+        File.exists?(File.join(destination, "shard.lock")).should be_false
+        readme = File.read(File.join(destination, "README.md"))
+        readme.should contain("shards install")
+        readme.should contain("crystal spec")
+        readme.should contain("writes a checksum-verified `shard.lock`")
+        readme.scan(/shards-alpha install/).size.should eq(1)
+
+        amber_config_template = File.read(File.expand_path("../../src/amber_cli/templates/app/.amber.yml.ecr", __DIR__))
+        amber_config_template.should contain("AMBER_ENV=test crystal spec")
+        amber_config_template.should_not contain("crystal-alpha")
+
         amber_config = YAML.parse(File.read(File.join(destination, ".amber.yml")))
         amber_config["database"].as_s.should eq("sqlite")
         amber_config["model"].as_s.should eq("grant")
diff --git a/spec/generators/native_app_spec.cr b/spec/generators/native_app_spec.cr
index 36eb1a1..3d829f4 100644
--- a/spec/generators/native_app_spec.cr
+++ b/spec/generators/native_app_spec.cr
@@ -32,6 +32,9 @@ describe AmberCLI::Generators::NativeApp do
         shard_content.should contain("amber:")
         shard_content.should contain("github: amberframework/amber")
         shard_content.should contain("version: 2.0.0-beta.5")
+        shard_content.should contain("github: crimson-knight/grant")
+        shard_content.should contain("commit: 70ac8beaa172f03c389bacaff06cd8f3c520805c")
+        File.exists?(File.join(project_path, "shard.lock")).should be_false
 
         # Must have the released asset_pipeline with cross-platform UI support
         shard_content.should contain("asset_pipeline:")
@@ -132,9 +135,11 @@ describe AmberCLI::Generators::NativeApp do
         makefile_content.should contain("macos-release:")
         makefile_content.should contain("setup:")
         makefile_content.should contain("spec:")
-        makefile_content.should contain("command -v shards-alpha")
+        makefile_content.should contain("if command -v shards-alpha >/dev/null 2>&1; then")
+        makefile_content.should contain("shards-alpha install;")
+        makefile_content.should contain("else")
+        makefile_content.should contain("shards install;")
         makefile_content.should contain("$(CRYSTAL) spec spec/ -Dmacos")
-        makefile_content.should_not contain("shards install || true")
       end
     end
 
diff --git a/src/amber_cli/commands/new.cr b/src/amber_cli/commands/new.cr
index 0876509..506c431 100644
--- a/src/amber_cli/commands/new.cr
+++ b/src/amber_cli/commands/new.cr
@@ -43,6 +43,11 @@ module AmberCLI::Commands
     getter no_deps : Bool = false
     getter name : String = ""
 
+    # :nodoc:
+    def self.find_shards_executable(path_lookup : Proc(String, String?)) : String?
+      path_lookup.call("shards-alpha") || path_lookup.call("shards")
+    end
+
     def help_description : String
       "Generates a new Amber V2 project"
     end
@@ -197,8 +202,9 @@ module AmberCLI::Commands
 
     private def install_dependencies(path : String)
       info "Installing dependencies..."
+      shards_executable = self.class.find_shards_executable(->(command : String) { Process.find_executable(command) })
       status = Process.run(
-        "shards",
+        shards_executable || "shards",
         ["install"],
         chdir: path,
         input: Process::Redirect::Inherit,
@@ -287,7 +293,7 @@ dependencies:
     version: 2.0.0-beta.5
   grant:
     github: crimson-knight/grant
-    commit: 2665a978b43ac608c68cde9243821f8f8f053372
+    commit: 70ac8beaa172f03c389bacaff06cd8f3c520805c
   asset_pipeline:
     github: amberframework/asset_pipeline
     version: ~> 0.37.0
@@ -330,6 +336,8 @@ amber database migrate
 amber watch
 ```
 
+`shards-alpha install` writes a checksum-verified `shard.lock` when `shards-alpha` is installed; commit the lock with the application.
+
 Open <http://127.0.0.1:3000> for the starter page or
 <http://127.0.0.1:3000/pets/new> after generating the example scaffold.
 
diff --git a/src/amber_cli/generators/native_app.cr b/src/amber_cli/generators/native_app.cr
index fad6175..2372163 100644
--- a/src/amber_cli/generators/native_app.cr
+++ b/src/amber_cli/generators/native_app.cr
@@ -123,7 +123,7 @@ dependencies:
   # Grant ORM (ActiveRecord-style, replaces Granite in V2)
   grant:
     github: crimson-knight/grant
-    commit: 2665a978b43ac608c68cde9243821f8f8f053372
+    commit: 70ac8beaa172f03c389bacaff06cd8f3c520805c
 
   # Asset Pipeline (cross-platform UI: AppKit, UIKit, Android Views)
   asset_pipeline:
@@ -246,10 +246,10 @@ all: macos
 # --- First-time setup ---
 
 setup:
-	@if command -v shards-alpha >/dev/null 2>&1; then \
-		shards-alpha install; \
-	else \
-		shards install; \
+	@if command -v shards-alpha >/dev/null 2>&1; then \\
+		shards-alpha install; \\
+	else \\
+		shards install; \\
 	fi
 	@# crystal-audio shard name has a hyphen but source uses underscore
 	@# Crystal's require resolution needs the underscore directory
diff --git a/src/amber_cli/templates/app/README.md.ecr b/src/amber_cli/templates/app/README.md.ecr
index 73431ab..fb1f256 100644
--- a/src/amber_cli/templates/app/README.md.ecr
+++ b/src/amber_cli/templates/app/README.md.ecr
@@ -14,6 +14,8 @@ amber database migrate
 amber watch
 ```
 
+`shards-alpha install` writes a checksum-verified `shard.lock` when `shards-alpha` is installed; commit the lock with the application.
+
 Open <http://127.0.0.1:3000>. Authored CSS, JavaScript, images, fonts, and other
 files live under `app/assets/`. `amber assets build` fingerprints them into the
 generated, gitignored `public/assets/` tree and writes `manifest.json`; edit the
diff --git a/src/amber_cli/templates/app/shard.yml.ecr b/src/amber_cli/templates/app/shard.yml.ecr
index d82e560..3790e62 100644
--- a/src/amber_cli/templates/app/shard.yml.ecr
+++ b/src/amber_cli/templates/app/shard.yml.ecr
@@ -18,7 +18,7 @@ dependencies:
     version: 2.0.0-beta.5
   grant:
     github: crimson-knight/grant
-    commit: 2665a978b43ac608c68cde9243821f8f8f053372
+    commit: 70ac8beaa172f03c389bacaff06cd8f3c520805c
   asset_pipeline:
     github: amberframework/asset_pipeline
     version: ~> 0.37.0