diff --git a/tools/run_tool.sh b/.devcontainer/run-tool
similarity index 92%
rename from tools/run_tool.sh
rename to .devcontainer/run-tool
index e4fa335b7..7821981d0 100755
--- a/tools/run_tool.sh
+++ b/.devcontainer/run-tool
@@ -16,6 +16,9 @@
 # Unified entry point for running a CLI tool by name.
 # Inside a container the tool is expected on PATH; outside, it is resolved via Bazel.
 # See https://github.com/eclipse-score/devcontainer/tree/main/tools for further information.
+#
+# Do not modify this file. Its source of truth is managed by the
+# SCORE devcontainer standardization policy.
 
 set -euo pipefail
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 646c8e934..2726c4e3b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -46,20 +46,20 @@ repos:
       - id: actionlint
         name: actionlint
         # Disable shellcheck and pyflakes for now, to enforce consistent behavior.
-        entry: tools/run_tool.sh actionlint -shellcheck= -pyflakes=
+        entry: .devcontainer/run-tool actionlint -shellcheck= -pyflakes=
         language: system
         require_serial: true
         types: [yaml]
         files: ^\.github/workflows/
       - id: ruff-check
         name: ruff-check
-        entry: tools/run_tool.sh ruff check --fix
+        entry: .devcontainer/run-tool ruff check --fix
         language: system
         require_serial: true
         types: [python]
       - id: ruff-format
         name: ruff-format
-        entry: tools/run_tool.sh ruff format
+        entry: .devcontainer/run-tool ruff format
         language: system
         require_serial: true
         types: [python]