diff --git a/internal/cmd/agecmd.go b/internal/cmd/agecmd.go
index 640e52ecbb7..f3e0d5d93e8 100644
--- a/internal/cmd/agecmd.go
+++ b/internal/cmd/agecmd.go
@@ -28,6 +28,9 @@ func (c *Config) newAgeCmd() *cobra.Command {
 		Use:   "age",
 		Args:  cobra.NoArgs,
 		Short: "Interact with age",
+		Annotations: newAnnotations(
+			persistentStateModeReadOnly,
+		),
 	}
 
 	ageDecryptCmd := &cobra.Command{
diff --git a/internal/cmd/annotation.go b/internal/cmd/annotation.go
index 096ea88b692..7d13374e33e 100644
--- a/internal/cmd/annotation.go
+++ b/internal/cmd/annotation.go
@@ -1,8 +1,6 @@
 package cmd
 
 import (
-	"slices"
-
 	"github.com/spf13/cobra"
 )
 
@@ -39,17 +37,6 @@ type annotation interface {
 type annotationsSet map[string]string
 
 func getAnnotations(cmd *cobra.Command) annotationsSet {
-	thirdPartyCommandNames := []string{
-		"__complete",
-	}
-	if !slices.Contains(thirdPartyCommandNames, cmd.Name()) {
-		if cmd.Annotations == nil {
-			panic(cmd.Name() + ": no annotations")
-		}
-		if cmd.Annotations[string(persistentStateModeKey)] == "" {
-			panic(cmd.Name() + ": persistent state mode not set")
-		}
-	}
 	return annotationsSet(cmd.Annotations)
 }
 
@@ -66,7 +53,7 @@ func (a annotationsSet) hasTag(tag annotation) bool {
 }
 
 func (a annotationsSet) persistentStateMode() persistentStateModeValue {
-	return persistentStateModeValue(a[string(persistentStateModeKey)])
+	return persistentStateModeValue(a[persistentStateModeKey.key()])
 }
 
 type persistentStateModeValue string
diff --git a/internal/cmd/config.go b/internal/cmd/config.go
index 6dcc0b913dc..a85baa3f5b5 100644
--- a/internal/cmd/config.go
+++ b/internal/cmd/config.go
@@ -1746,6 +1746,16 @@ func (c *Config) newRootCmd() (*cobra.Command, error) {
 		}
 	}
 
+	for _, cmd := range rootCmd.Commands() {
+		annotations := getAnnotations(cmd)
+		if len(annotations) == 0 {
+			panic(cmd.Name() + ": no annotations")
+		}
+		if annotations.persistentStateMode() == "" {
+			panic(cmd.Name() + ": persistent state mode not set")
+		}
+	}
+
 	return rootCmd, nil
 }
 
diff --git a/internal/cmd/internaltestcmd.go b/internal/cmd/internaltestcmd.go
index e88f620ccb0..c818d95e293 100644
--- a/internal/cmd/internaltestcmd.go
+++ b/internal/cmd/internaltestcmd.go
@@ -14,6 +14,9 @@ func (c *Config) newInternalTestCmd() *cobra.Command {
 		Use:    "internal-test",
 		Short:  "Expose functionality for testing",
 		Hidden: true,
+		Annotations: newAnnotations(
+			persistentStateModeNone,
+		),
 	}
 
 	internalTestPromptBoolCmd := &cobra.Command{
@@ -23,6 +26,7 @@ func (c *Config) newInternalTestCmd() *cobra.Command {
 		RunE:  c.runInternalTestPromptBoolCmd,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	internalTestCmd.AddCommand(internalTestPromptBoolCmd)
@@ -34,6 +38,7 @@ func (c *Config) newInternalTestCmd() *cobra.Command {
 		RunE:  c.runInternalTestPromptChoiceCmd,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	internalTestCmd.AddCommand(internalTestPromptChoiceCmd)
@@ -45,6 +50,7 @@ func (c *Config) newInternalTestCmd() *cobra.Command {
 		RunE:  c.runInternalTestPromptIntCmd,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	internalTestCmd.AddCommand(internalTestPromptIntCmd)
@@ -56,6 +62,7 @@ func (c *Config) newInternalTestCmd() *cobra.Command {
 		RunE:  c.runInternalTestPromptStringCmd,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	internalTestCmd.AddCommand(internalTestPromptStringCmd)
@@ -67,6 +74,7 @@ func (c *Config) newInternalTestCmd() *cobra.Command {
 		RunE:  c.runInternalTestReadPasswordCmd,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	internalTestCmd.AddCommand(internalTestReadPasswordCmd)
diff --git a/internal/cmd/mackupcmd_darwin.go b/internal/cmd/mackupcmd_darwin.go
index 0e307b66857..b693d417de0 100644
--- a/internal/cmd/mackupcmd_darwin.go
+++ b/internal/cmd/mackupcmd_darwin.go
@@ -36,6 +36,9 @@ func (c *Config) newMackupCmd() *cobra.Command {
 		Use:    "mackup",
 		Short:  "Interact with Mackup",
 		Hidden: true,
+		Annotations: newAnnotations(
+			persistentStateModeNone,
+		),
 	}
 
 	mackupAddCmd := &cobra.Command{
diff --git a/internal/cmd/removecmd.go b/internal/cmd/removecmd.go
index 7225c7acfe3..61f42ee47b2 100644
--- a/internal/cmd/removecmd.go
+++ b/internal/cmd/removecmd.go
@@ -15,6 +15,7 @@ func (c *Config) newRemoveCmd() *cobra.Command {
 		Long:       mustLongHelp("remove"),
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 
diff --git a/internal/cmd/secretcmd.go b/internal/cmd/secretcmd.go
index e284668654f..e39619b6aeb 100644
--- a/internal/cmd/secretcmd.go
+++ b/internal/cmd/secretcmd.go
@@ -13,6 +13,9 @@ func (c *Config) newSecretCmd() *cobra.Command {
 		Short:   "Interact with a secret manager",
 		Long:    mustLongHelp("secret"),
 		Example: example("secret"),
+		Annotations: newAnnotations(
+			persistentStateModeReadOnly,
+		),
 	}
 
 	if secretKeyringCmd := c.newSecretKeyringCmd(); secretKeyringCmd != nil {
diff --git a/internal/cmd/secretkeyringcmd.go b/internal/cmd/secretkeyringcmd.go
index 85c4b7b88a6..a1d49a997d5 100644
--- a/internal/cmd/secretkeyringcmd.go
+++ b/internal/cmd/secretkeyringcmd.go
@@ -34,6 +34,9 @@ func (c *Config) newSecretKeyringCmd() *cobra.Command {
 		Use:   "keyring",
 		Args:  cobra.NoArgs,
 		Short: "Interact with keyring",
+		Annotations: newAnnotations(
+			persistentStateModeNone,
+		),
 	}
 
 	secretKeyringDeleteCmd := &cobra.Command{
@@ -43,6 +46,7 @@ func (c *Config) newSecretKeyringCmd() *cobra.Command {
 		RunE:  c.runSecretKeyringDeleteCmdE,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	secretKeyringDeleteCmd.Flags().StringVar(&c.secret.keyring.delete.service, "service", "", "service")
@@ -57,6 +61,7 @@ func (c *Config) newSecretKeyringCmd() *cobra.Command {
 		RunE:  c.runSecretKeyringGetCmdE,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	secretKeyringGetCmd.Flags().StringVar(&c.secret.keyring.get.service, "service", "", "service")
@@ -71,6 +76,7 @@ func (c *Config) newSecretKeyringCmd() *cobra.Command {
 		RunE:  c.runSecretKeyringSetCmdE,
 		Annotations: newAnnotations(
 			doesNotRequireValidConfig,
+			persistentStateModeNone,
 		),
 	}
 	secretKeyringSetCmd.Flags().StringVar(&c.secret.keyring.set.service, "service", "", "service")
diff --git a/internal/cmd/statecmd.go b/internal/cmd/statecmd.go
index 568b5f67cfa..41caaf34a0c 100644
--- a/internal/cmd/statecmd.go
+++ b/internal/cmd/statecmd.go
@@ -48,6 +48,9 @@ func (c *Config) newStateCmd() *cobra.Command {
 		Short:   "Manipulate the persistent state",
 		Long:    mustLongHelp("state"),
 		Example: example("state"),
+		Annotations: newAnnotations(
+			persistentStateModeNone,
+		),
 	}
 
 	stateDataCmd := &cobra.Command{