diff --git a/Dockerfile b/Dockerfile
index 2df511c..0ede0b2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,7 +19,7 @@ ARG \
   # renovate: datasource=go depName=github.com/sqlc-dev/sqlc
   SQLC_VERSION=v1.31.1
 
-FROM node:24-trixie@sha256:eb2c73a27cf714b4b6b030f88ab72e62192c38b7d313ea3456695b8ae03c5f3c AS go-tools-builder
+FROM node:24-trixie@sha256:dfa43abae25030f5456007944f725379d1f5be4bb723bd501ac39ac72ffa5474 AS go-tools-builder
 
 ARG \
   TARGETARCH \
@@ -61,7 +61,7 @@ RUN --mount=type=cache,id=go-tools-mod-${TARGETARCH},sharing=locked,target=/root
   go install github.com/bufbuild/buf/cmd/buf@"${BUF_VERSION}" && \
   go install github.com/sqlc-dev/sqlc/cmd/sqlc@"${SQLC_VERSION}"
 
-FROM node:24-trixie@sha256:eb2c73a27cf714b4b6b030f88ab72e62192c38b7d313ea3456695b8ae03c5f3c
+FROM node:24-trixie@sha256:dfa43abae25030f5456007944f725379d1f5be4bb723bd501ac39ac72ffa5474
 
 ARG TZ
 ENV TZ="$TZ"
@@ -84,11 +84,11 @@ ARG \
   # renovate: datasource=repology depName=debian_13/bubblewrap
   BW_VERSION=0.11.0-2+deb13u1 \
   # renovate: datasource=deb depName=docker-ce
-  DOCKER_CE_VERSION=5:29.6.2-1~debian.13~trixie \
+  DOCKER_CE_VERSION=5:29.7.0-1~debian.13~trixie \
   # renovate: datasource=deb depName=containerd.io
   CONTAINERD_IO_VERSION=2.2.6-1~debian.13~trixie \
   # renovate: datasource=deb depName=docker-buildx-plugin
-  DOCKER_BUILDX_PLUGIN_VERSION=0.35.0-1~debian.13~trixie \
+  DOCKER_BUILDX_PLUGIN_VERSION=0.36.0-1~debian.13~trixie \
   # renovate: datasource=deb depName=docker-compose-plugin
   DOCKER_COMPOSE_PLUGIN_VERSION=5.3.1-1~debian.13~trixie \
   # renovate: datasource=repology depName=debian_13/fzf
@@ -261,11 +261,11 @@ ARG \
   # renovate: datasource=npm depName=@anthropic-ai/claude-code
   CLAUDE_CLI_VERSION=2.1.220 \
   # renovate: datasource=npm depName=@openai/codex
-  CODEX_CLI_VERSION=0.145.0 \
+  CODEX_CLI_VERSION=0.146.0 \
   # renovate: datasource=npm depName=@google/gemini-cli
   GEMINI_CLI_VERSION=0.52.0 \
   # renovate: datasource=npm depName=opencode-ai
-  OPENCODE_AI_VERSION=1.18.5 \
+  OPENCODE_AI_VERSION=1.18.8 \
   # renovate: datasource=npm depName=@earendil-works/pi-coding-agent
   PI_CLI_VERSION=0.82.1 \
   CLI=""