diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index cce0182..f840d72 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -15,7 +15,7 @@ jobs:
           verbose: true
   push:
     needs: [lint]
-    uses: libops/.github/.github/workflows/build-push.yaml@5f44a8c8d157bb7e5cf6d9e1c98847a604e87455 # main
+    uses: libops/.github/.github/workflows/build-push.yaml@7277eacc89fca014481b2ca66039f4176509bcfc # main
     permissions:
       contents: read
       packages: write
diff --git a/Dockerfile b/Dockerfile
index 78b6a37..d0a03ea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ ARG \
   # renovate: datasource=go depName=golang.org/x/vuln
   GOVULNCHECK_VERSION=v1.7.0 \
   # renovate: datasource=go depName=github.com/securego/gosec/v2
-  GOSEC_VERSION=v2.28.0 \
+  GOSEC_VERSION=v2.29.0 \
   # renovate: datasource=go depName=github.com/rhysd/actionlint
   ACTIONLINT_VERSION=v1.7.12 \
   # renovate: datasource=go depName=github.com/bufbuild/buf
@@ -19,7 +19,7 @@ ARG \
   # renovate: datasource=go depName=github.com/sqlc-dev/sqlc
   SQLC_VERSION=v1.31.1
 
-FROM node:24-trixie@sha256:66bb8d36ae1ddd72199ed235a089904874ca4079ee517936ca3adb80506a75c1 AS go-tools-builder
+FROM node:24-trixie@sha256:f7d34e58713740f9eef9092c0bd6ff10369d132f7238399a4b270f16d47fa608 AS go-tools-builder
 
 ARG \
   TARGETARCH \
@@ -61,7 +61,7 @@ RUN --mount=type=cache,id=go-tools-mod-${TARGETARCH},sharing=locked,target=/root
   go install github.com/bufbuild/buf/cmd/buf@"${BUF_VERSION}" && \
   go install github.com/sqlc-dev/sqlc/cmd/sqlc@"${SQLC_VERSION}"
 
-FROM node:24-trixie@sha256:66bb8d36ae1ddd72199ed235a089904874ca4079ee517936ca3adb80506a75c1
+FROM node:24-trixie@sha256:f7d34e58713740f9eef9092c0bd6ff10369d132f7238399a4b270f16d47fa608
 
 ARG TZ
 ENV TZ="$TZ"
@@ -82,7 +82,7 @@ ARG \
   # renovate: datasource=repology depName=debian_13/bind9
   BIND9_VERSION=1:9.20.26-1~deb13u1 \
   # renovate: datasource=repology depName=debian_13/bubblewrap
-  BW_VERSION=0.11.0-2+deb13u1 \
+  BW_VERSION=0.12.0-1~deb13u1 \
   # renovate: datasource=deb depName=docker-ce
   DOCKER_CE_VERSION=5:29.7.2-1~debian.13~trixie \
   # renovate: datasource=deb depName=containerd.io
@@ -259,11 +259,11 @@ ENV \
 
 ARG \
   # renovate: datasource=npm depName=@anthropic-ai/claude-code
-  CLAUDE_CLI_VERSION=2.1.239 \
+  CLAUDE_CLI_VERSION=2.1.245 \
   # renovate: datasource=npm depName=@openai/codex
   CODEX_CLI_VERSION=0.149.1 \
   # renovate: datasource=npm depName=@earendil-works/pi-coding-agent
-  PI_CLI_VERSION=0.84.2 \
+  PI_CLI_VERSION=0.84.3 \
   CLI=""
 
 RUN if [ -n "$CLI" ]; then \