diff --git a/docs/administration/server-configuration.mdx b/docs/administration/server-configuration.mdx
index fbe96792a..d0b1af620 100644
--- a/docs/administration/server-configuration.mdx
+++ b/docs/administration/server-configuration.mdx
@@ -9,7 +9,7 @@ The server config file at `~/.arc/server.toml` controls how `arc serve` behaves
 
 ### Full reference
 
-```toml
+```toml title="server.toml"
 # Maximum concurrent workflow runs (default: 5)
 max_concurrent_runs = 8
 
diff --git a/docs/agents/hooks.mdx b/docs/agents/hooks.mdx
index b0b8f3872..753de210a 100644
--- a/docs/agents/hooks.mdx
+++ b/docs/agents/hooks.mdx
@@ -13,7 +13,7 @@ Arc supports four hook types, from simple shell commands to full agent sessions:
 
 Run a shell command via `sh -c`. The simplest and most common hook type.
 
-```toml
+```toml title="run.toml"
 [[hooks]]
 event = "stage_start"
 command = "./scripts/pre-check.sh"
@@ -23,7 +23,7 @@ command = "./scripts/pre-check.sh"
 
 POST the event context as JSON to an HTTP endpoint. Useful for webhooks, external APIs, and notification services.
 
-```toml
+```toml title="run.toml"
 [[hooks]]
 event = "run_complete"
 type = "http"
@@ -44,7 +44,7 @@ Authorization = "Bearer $API_KEY"
 
 A single-turn LLM call that evaluates the event context and returns an `ok`/`block` decision. The model responds with structured JSON.
 
-```toml
+```toml title="run.toml"
 [[hooks]]
 event = "stage_start"
 type = "prompt"
@@ -62,7 +62,7 @@ blocking = true
 
 A multi-turn agent session with full tool access (shell, file read/write, grep, glob). The agent can investigate the workspace before making a decision.
 
-```toml
+```toml title="run.toml"
 [[hooks]]
 event = "run_complete"
 type = "agent"
@@ -102,7 +102,7 @@ Each hook fires on a specific lifecycle event:
 
 Hooks are defined as `[[hooks]]` entries in a [run configuration](/execution/run-configuration) TOML file:
 
-```toml
+```toml title="run.toml"
 [[hooks]]
 name = "pre-check"
 event = "stage_start"
@@ -191,7 +191,7 @@ The `matcher` field is a regex pattern that filters which stages trigger a hook.
 
 If any of these fields match the regex, the hook fires. If `matcher` is omitted, the hook fires for all stages of the specified event.
 
-```toml
+```toml title="run.toml"
 # Only fire for agent nodes
 [[hooks]]
 event = "stage_start"
@@ -285,7 +285,7 @@ When both the server config (`~/.arc/server.toml`) and a run config define hooks
 
 ## Full example
 
-```toml
+```toml title="run.toml"
 # Validate environment before the run starts
 [[hooks]]
 name = "env-check"
diff --git a/docs/api-reference/overview.mdx b/docs/api-reference/overview.mdx
index 2deb43953..053750cdf 100644
--- a/docs/api-reference/overview.mdx
+++ b/docs/api-reference/overview.mdx
@@ -15,7 +15,7 @@ http://localhost:3000
 
 The base URL is configurable via `server.toml`:
 
-```toml
+```toml title="server.toml"
 [api]
 base_url = "https://arc.example.com"
 ```
@@ -24,7 +24,7 @@ base_url = "https://arc.example.com"
 
 The API supports two authentication strategies, configured in `server.toml`:
 
-```toml
+```toml title="server.toml"
 [api]
 authentication_strategies = ["jwt"]
 ```
@@ -54,7 +54,7 @@ Set the verification key via the `ARC_JWT_PUBLIC_KEY` environment variable (PEM
 
 With mTLS, the client authenticates using a TLS client certificate. Configure both the strategy and TLS paths:
 
-```toml
+```toml title="server.toml"
 [api]
 authentication_strategies = ["mtls"]
 
@@ -70,7 +70,7 @@ The Common Name (CN) from the client certificate identifies the user.
 
 You can configure both strategies. They are tried in order — the first successful match wins:
 
-```toml
+```toml title="server.toml"
 [api]
 authentication_strategies = ["jwt", "mtls"]
 ```
diff --git a/docs/changelog/2026-02-26.mdx b/docs/changelog/2026-02-26.mdx
index 689131c19..a253cd120 100644
--- a/docs/changelog/2026-02-26.mdx
+++ b/docs/changelog/2026-02-26.mdx
@@ -15,7 +15,7 @@ arc run start --execution-env daytona my-workflow.dot
 
 Long chains of CLI flags are hard to remember and impossible to version-control. Run settings now live in a TOML file with `[execution]` for sandbox config and `[vars]` for DOT source parameterization.
 
-```toml
+```toml title="run.toml"
 [execution]
 environment = "daytona"
 
diff --git a/docs/changelog/2026-03-05.mdx b/docs/changelog/2026-03-05.mdx
index ed2ac4c19..16d94674f 100644
--- a/docs/changelog/2026-03-05.mdx
+++ b/docs/changelog/2026-03-05.mdx
@@ -15,7 +15,7 @@ Workflows can now trigger actions at key moments — before a stage starts, afte
 
 Three executor types are available: `http` for calling external endpoints (with TLS mode configurable per-hook), `prompt` for natural-language conditions evaluated by an LLM, and `agent` for autonomous decision-making.
 
-```toml
+```toml title="run.toml"
 [[hooks]]
 event = "stage.before"
 executor = "http"
@@ -27,7 +27,7 @@ tls_mode = "strict"
 
 If your primary model is unavailable or rate-limited, runs now automatically switch to a backup. Configure fallback models at the provider level in your server config:
 
-```toml
+```toml title="server.toml"
 [providers.anthropic]
 failover = ["openai", "gemini"]
 ```
diff --git a/docs/changelog/2026-03-07.mdx b/docs/changelog/2026-03-07.mdx
index 6ce960e9a..d55a56b74 100644
--- a/docs/changelog/2026-03-07.mdx
+++ b/docs/changelog/2026-03-07.mdx
@@ -7,7 +7,7 @@ date: "2026-03-07"
 
 Arc can now run agent stages inside ephemeral [exe.dev](https://exe.dev) VMs as an alternative to Daytona sandboxes. The new `arc-exe` crate manages VM lifecycle through SSH — a management plane connection to `exe.dev` for creating and destroying VMs, and a data plane connection to the VM itself for command execution and file I/O.
 
-```toml
+```toml title="run.toml"
 [execution]
 environment = "exe"
 ```
diff --git a/docs/core-concepts/models.mdx b/docs/core-concepts/models.mdx
index 73b12402e..a09a4aa2e 100644
--- a/docs/core-concepts/models.mdx
+++ b/docs/core-concepts/models.mdx
@@ -88,7 +88,7 @@ These flags set the default model for all nodes that don't have an explicit mode
 
 For repeatable runs, set the model in a run config file:
 
-```toml
+```toml title="run.toml"
 version = 1
 goal = "Implement the feature"
 graph = "implement.dot"
diff --git a/docs/examples/semantic-port.mdx b/docs/examples/semantic-port.mdx
index 508245254..77cc6e4ce 100644
--- a/docs/examples/semantic-port.mdx
+++ b/docs/examples/semantic-port.mdx
@@ -213,7 +213,7 @@ The stylesheet assigns three tiers of models:
 
 Pair the workflow with a run config TOML for repeatable execution:
 
-```toml
+```toml title="run.toml"
 version = 1
 goal = "Port semantic changes from upstream openai-agents-python to our Go SDK"
 graph = "semport.dot"
diff --git a/docs/examples/solitaire.mdx b/docs/examples/solitaire.mdx
index 02bdb1a3f..72e9f5f3a 100644
--- a/docs/examples/solitaire.mdx
+++ b/docs/examples/solitaire.mdx
@@ -254,7 +254,7 @@ This is more reliable than a single "implement everything" node because:
 
 Pair the workflow with a run config for repeatable execution:
 
-```toml
+```toml title="run.toml"
 version = 1
 goal = "Build a terminal-based solitaire (Klondike) game in Python"
 graph = "build-solitaire.dot"
diff --git a/docs/execution/environments.mdx b/docs/execution/environments.mdx
index f34dc6208..bb4dbc771 100644
--- a/docs/execution/environments.mdx
+++ b/docs/execution/environments.mdx
@@ -26,7 +26,7 @@ arc run start workflow.dot --sandbox daytona
 arc run start workflow.dot --sandbox exe
 ```
 
-```toml
+```toml title="run.toml"
 # Run config TOML
 [sandbox]
 provider = "daytona"
@@ -95,7 +95,7 @@ arc run start workflow.dot --sandbox docker --preserve-sandbox
 
 Or in the run config:
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "docker"
 preserve = true
@@ -124,7 +124,7 @@ The Daytona sandbox runs all tool operations inside a cloud-hosted VM managed by
 
 Snapshots let you pre-build an environment image so each run starts with dependencies already installed. If the named snapshot doesn't exist and a `dockerfile` is provided, Arc creates it automatically and polls until it's ready (up to 10 minutes).
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "daytona"
 
@@ -153,7 +153,7 @@ If the snapshot already exists and is in `Active` state, Arc uses it directly. I
 
 Attach key-value labels to sandboxes for filtering and identification in the Daytona dashboard:
 
-```toml
+```toml title="run.toml"
 [sandbox.daytona.labels]
 project = "arc"
 env = "ci"
@@ -186,7 +186,7 @@ Arc prints the sandbox name so you can find it in the [Daytona dashboard](https:
 
 The `auto_stop_interval` setting (in minutes) tells Daytona to stop the sandbox after a period of inactivity. This saves costs for long-running sandboxes that may sit idle:
 
-```toml
+```toml title="run.toml"
 [sandbox.daytona]
 auto_stop_interval = 30
 ```
@@ -213,7 +213,7 @@ The Exe sandbox runs all tool operations inside a cloud VM managed by [exe.dev](
 
 ### Configuration
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "exe"
 ```
@@ -250,7 +250,7 @@ Each provider handles outbound network access differently:
 
 For Daytona, network access is configured in the `[sandbox.daytona]` section:
 
-```toml
+```toml title="run.toml"
 # Block all egress
 [sandbox.daytona]
 network = "block"
diff --git a/docs/execution/failures.mdx b/docs/execution/failures.mdx
index 91775a0b3..da45463c2 100644
--- a/docs/execution/failures.mdx
+++ b/docs/execution/failures.mdx
@@ -95,7 +95,7 @@ When a handler returns a `Retry` status instead of `Fail`, retries always procee
 
 When a model provider fails with a transient error or quota exhaustion, Arc can automatically switch to a different provider. Configure fallback chains in your [run configuration](/execution/run-configuration):
 
-```toml
+```toml title="run.toml"
 [llm]
 model = "claude-opus-4-6"
 provider = "anthropic"
diff --git a/docs/execution/run-configuration.mdx b/docs/execution/run-configuration.mdx
index 5733dbc18..9ee5e508f 100644
--- a/docs/execution/run-configuration.mdx
+++ b/docs/execution/run-configuration.mdx
@@ -13,7 +13,7 @@ arc run start run.toml
 
 A run config requires three fields:
 
-```toml
+```toml title="run.toml"
 version = 1
 goal = "Implement the login feature"
 graph = "workflow.dot"
@@ -27,7 +27,7 @@ graph = "workflow.dot"
 
 ## Full example
 
-```toml
+```toml title="run.toml"
 version = 1
 goal = "Run the CI pipeline for $repo_name"
 graph = "pipelines/ci.dot"
@@ -84,7 +84,7 @@ command = "echo done"
 
 Override the default model and provider for all nodes that don't have an explicit model assigned via a [stylesheet](/workflows/stylesheets).
 
-```toml
+```toml title="run.toml"
 [llm]
 model = "claude-sonnet-4-5"
 provider = "anthropic"
@@ -99,7 +99,7 @@ provider = "anthropic"
 
 Map each provider to an ordered list of fallback providers. When the primary provider is unavailable, Arc tries the fallbacks in order:
 
-```toml
+```toml title="run.toml"
 [llm.fallbacks]
 anthropic = ["gemini", "openai"]
 gemini = ["anthropic", "openai"]
@@ -109,7 +109,7 @@ gemini = ["anthropic", "openai"]
 
 Shell commands to run before the workflow starts. Use this to clone repositories, install dependencies, or prepare the environment.
 
-```toml
+```toml title="run.toml"
 [setup]
 commands = ["pip install -r requirements.txt", "npm install"]
 timeout_ms = 60000
@@ -126,7 +126,7 @@ Each command must exit with status 0. If any command fails or times out, the run
 
 Configure how agent tools (bash, file edits) are executed.
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "docker"
 preserve = true
@@ -141,7 +141,7 @@ preserve = true
 
 Additional settings when using the Daytona cloud sandbox:
 
-```toml
+```toml title="run.toml"
 [sandbox.daytona]
 auto_stop_interval = 60
 
@@ -172,7 +172,7 @@ dockerfile = "FROM rust:1.85-slim-bookworm\nRUN apt-get update"
 
 Define variables that are expanded into the DOT source before the graph is parsed. See [Variables](/workflows/variables) for the full reference.
 
-```toml
+```toml title="run.toml"
 [vars]
 repo_name = "arc"
 repo_url = "https://github.com/qltysh/arc"
@@ -195,7 +195,7 @@ If a `$variable` in the DOT file has no matching entry in `[vars]`, Arc raises a
 
 Define hooks that run in response to lifecycle events. Each hook is a TOML array entry:
 
-```toml
+```toml title="run.toml"
 [[hooks]]
 name = "pre-check"
 event = "stage_start"
diff --git a/docs/human-tools/ssh-access.mdx b/docs/human-tools/ssh-access.mdx
index 7c9aa33f1..6dbc42dbf 100644
--- a/docs/human-tools/ssh-access.mdx
+++ b/docs/human-tools/ssh-access.mdx
@@ -38,7 +38,7 @@ Without `--preserve-sandbox`, the SSH session is terminated when the run ends an
 
 You can also set `auto_stop_interval` in your run config to control how long an idle sandbox stays alive:
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "daytona"
 preserve = true
diff --git a/docs/integrations/daytona.mdx b/docs/integrations/daytona.mdx
index df1155a12..f871a1ade 100644
--- a/docs/integrations/daytona.mdx
+++ b/docs/integrations/daytona.mdx
@@ -27,14 +27,14 @@ Set the sandbox provider in your run config TOML or via CLI flag:
 arc run start workflow.dot --sandbox daytona
 ```
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "daytona"
 ```
 
 A full configuration example with all Daytona-specific options:
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "daytona"
 preserve = false
@@ -61,7 +61,7 @@ See [Server Configuration](/administration/server-configuration) for the full re
 
 Control outbound network access with the `network` field. Three modes are available:
 
-```toml
+```toml title="run.toml"
 # Full access (default)
 [sandbox.daytona]
 network = "allow_all"
@@ -81,7 +81,7 @@ Use `"block"` or a CIDR allow list when running untrusted or generated code to p
 
 Snapshots let you pre-build an environment image so each run starts with dependencies already installed rather than installing them in setup commands every time.
 
-```toml
+```toml title="run.toml"
 [sandbox.daytona.snapshot]
 name = "my-snapshot"
 cpu = 4
@@ -140,7 +140,7 @@ arc run start workflow.dot --sandbox daytona --preserve-sandbox
 
 Or in the run config:
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "daytona"
 preserve = true
@@ -152,7 +152,7 @@ When preserved, Arc prints the sandbox name so you can find it in the [Daytona d
 
 The `auto_stop_interval` setting tells Daytona to stop the sandbox after a period of inactivity, saving costs for preserved or long-running sandboxes:
 
-```toml
+```toml title="run.toml"
 [sandbox.daytona]
 auto_stop_interval = 30
 ```
diff --git a/docs/integrations/exe-dev.mdx b/docs/integrations/exe-dev.mdx
index d0c5799f1..2d75113c2 100644
--- a/docs/integrations/exe-dev.mdx
+++ b/docs/integrations/exe-dev.mdx
@@ -22,7 +22,7 @@ The exe.dev sandbox provider is in **beta** and not yet generally available. Thi
 arc run start workflow.dot --sandbox exe
 ```
 
-```toml
+```toml title="run.toml"
 [sandbox]
 provider = "exe"
 ```
diff --git a/docs/integrations/github.mdx b/docs/integrations/github.mdx
index f5b5d31f6..6418a087c 100644
--- a/docs/integrations/github.mdx
+++ b/docs/integrations/github.mdx
@@ -72,7 +72,7 @@ The GitHub App configuration lives in two places:
 
 ### `~/.arc/server.toml`
 
-```toml
+```toml title="server.toml"
 [git]
 provider = "github"
 app_id = "123456"
@@ -112,7 +112,7 @@ The web app uses the GitHub App's OAuth credentials to authenticate users:
 
 Configure allowed users in `server.toml`:
 
-```toml
+```toml title="server.toml"
 [web.auth]
 provider = "github"
 allowed_usernames = ["alice", "bob"]
diff --git a/docs/integrations/slack.mdx b/docs/integrations/slack.mdx
index c46cb7bc5..2b4769138 100644
--- a/docs/integrations/slack.mdx
+++ b/docs/integrations/slack.mdx
@@ -83,7 +83,7 @@ ARC_SLACK_APP_TOKEN=xapp-your-app-token
 
 Optionally, set a default channel in your [server configuration](/administration/server-configuration):
 
-```toml
+```toml title="server.toml"
 [slack]
 default_channel = "#arc-reviews"
 ```
diff --git a/docs/reference/cli-configuration.mdx b/docs/reference/cli-configuration.mdx
index fc8a7653a..7c283b9b5 100644
--- a/docs/reference/cli-configuration.mdx
+++ b/docs/reference/cli-configuration.mdx
@@ -19,7 +19,7 @@ CLI flags always take the highest priority:
 
 ## Full example
 
-```toml
+```toml title="cli.toml"
 mode = "server"
 
 [server]
@@ -119,7 +119,7 @@ Optional mTLS configuration for authenticating with the server. When present, th
 
 Paths support `~/` expansion. Example:
 
-```toml
+```toml title="cli.toml"
 [server.tls]
 cert = "~/.arc/tls/client.crt"
 key = "~/.arc/tls/client.key"
diff --git a/docs/reference/cli.mdx b/docs/reference/cli.mdx
index 4293a4d94..07f0bed48 100644
--- a/docs/reference/cli.mdx
+++ b/docs/reference/cli.mdx
@@ -20,7 +20,7 @@ Arc loads environment variables from `.env` in the current directory and `~/.arc
 
 CLI defaults can be set in `~/.arc/cli.toml` so you don't have to pass common flags every time:
 
-```toml
+```toml title="cli.toml"
 [agent]
 provider = "anthropic"
 model = "claude-opus-4-6"
diff --git a/docs/workflows/variables.mdx b/docs/workflows/variables.mdx
index a31a52441..5495c982c 100644
--- a/docs/workflows/variables.mdx
+++ b/docs/workflows/variables.mdx
@@ -9,7 +9,7 @@ Arc supports `$variable` placeholders that let you parameterize workflows withou
 
 Define variables in the `[vars]` section of a run config TOML file:
 
-```toml
+```toml title="run.toml"
 version = 1
 goal = "Run tests for $repo_name"
 graph = "check.dot"