diff --git a/versions.env b/versions.env
index 7c101ac..b484da6 100644
--- a/versions.env
+++ b/versions.env
@@ -8,15 +8,15 @@ DELTA_VERSION=0.19.2
 TMUX_VERSION=3.6a
 TMUX_SHA256=b6d8d9c76585db8ef5fa00d4931902fa4b8cbe8166f528f44fc403961a3f3759
 
-CLAUDE_CODE_VERSION=2.1.232
-CCTRACE_VERSION=0.40.0
-CODEX_VERSION=0.147.0
-GEMINI_CLI_VERSION=0.55.1
-GROK_CLI_VERSION=1.0.3
-KIMI_CODE_VERSION=0.36.0
+CLAUDE_CODE_VERSION=2.1.237
+CCTRACE_VERSION=0.43.1
+CODEX_VERSION=0.148.0
+GEMINI_CLI_VERSION=0.56.0
+GROK_CLI_VERSION=1.0.5
+KIMI_CODE_VERSION=0.37.2
 OPENCODE_VERSION=1.18.18
-PI_CODING_AGENT_VERSION=0.84.1
-DSH_VERSION=0.1.0-rc.6
+PI_CODING_AGENT_VERSION=0.84.2
+DSH_VERSION=0.1.0-rc.7
 # Cursor CLI. Not on npm; cursor.com/install hardcodes the version and
 # offers no pin hook, but the download URL is deterministic:
 # downloads.cursor.com/lab/<version>/linux/<arch>/agent-cli-package.tar.gz
@@ -28,11 +28,11 @@ PLAYWRIGHT_VERSION=1.62.1
 # CloakBrowser npm wrapper version. This also pins the Chromium binary:
 # the wrapper hardcodes per-arch free-binary versions (linux-x64 146.x.x.5,
 # linux-arm64 146.x.x.3), so bumping the wrapper is what moves Chromium.
-CLOAKBROWSER_WRAPPER_VERSION=0.5.7
+CLOAKBROWSER_WRAPPER_VERSION=0.5.8
 # Kimi WebBridge daemon + extension. No npm package; resolved from
 # cdn.kimi.com/webbridge/latest/version.json. Not consumed by any
 # build yet — Dockerfile.cloak starts baking it in #543.
-KIMI_WEBBRIDGE_VERSION=v1.11.5
+KIMI_WEBBRIDGE_VERSION=v1.11.6
 
 RUST_TOOLCHAINS=stable
 RUST_DEFAULT_TOOLCHAIN=stable