diff --git a/versions.env b/versions.env
index 7c101ac..8b024f7 100644
--- a/versions.env
+++ b/versions.env
@@ -2,37 +2,40 @@
 # Update this file when we intentionally move default toolchain or CLI versions.
 
 NODE_MAJOR=22
-GO_VERSION=1.26.6
+GO_VERSION=1.27.0
 PYTHON_VERSION=3.14t
 DELTA_VERSION=0.19.2
 TMUX_VERSION=3.6a
 TMUX_SHA256=b6d8d9c76585db8ef5fa00d4931902fa4b8cbe8166f528f44fc403961a3f3759
 
-CLAUDE_CODE_VERSION=2.1.232
-CCTRACE_VERSION=0.40.0
-CODEX_VERSION=0.147.0
-GEMINI_CLI_VERSION=0.55.1
-GROK_CLI_VERSION=1.0.3
-KIMI_CODE_VERSION=0.36.0
-OPENCODE_VERSION=1.18.18
-PI_CODING_AGENT_VERSION=0.84.1
-DSH_VERSION=0.1.0-rc.6
-# Cursor CLI. Not on npm; cursor.com/install hardcodes the version and
-# offers no pin hook, but the download URL is deterministic:
-# downloads.cursor.com/lab/<version>/linux/<arch>/agent-cli-package.tar.gz
-# so the image fetches the tarball directly. Version format YYYY.MM.DD-hash.
-CURSOR_CLI_VERSION=2026.08.11-e8db854
-CCX_VERSION=v0.15.0
+CLAUDE_CODE_VERSION=2.1.251
+CCTRACE_VERSION=0.45.0
+CODEX_VERSION=0.151.0
+GEMINI_CLI_VERSION=0.57.0
+GROK_CLI_VERSION=1.0.13
+KIMI_CODE_VERSION=0.39.1
+OPENCODE_VERSION=1.18.25
+PI_CODING_AGENT_VERSION=0.84.4
+DSH_VERSION=0.1.1-rc.2
+# Cursor CLI. DISABLED: empty pin = not installed, not version-tracked.
+# It is the one tool with no version API -- cursor.com/install hardcodes
+# the number -- so any build host that cannot reach cursor.com resolves it
+# to "" and breaks the whole image build. Not worth that for one CLI.
+# To re-enable, put a version back here (last known good:
+# 2026.08.25-3e8eec8). The image then fetches the tarball directly from
+# downloads.cursor.com/lab/<version>/linux/<arch>/agent-cli-package.tar.gz.
+CURSOR_CLI_VERSION=
+CCX_VERSION=v0.16.0
 COPILOT_API_VERSION=0ea08febdd7e3e055b03dd298bf57e669500b5c1
 PLAYWRIGHT_VERSION=1.62.1
 # CloakBrowser npm wrapper version. This also pins the Chromium binary:
 # the wrapper hardcodes per-arch free-binary versions (linux-x64 146.x.x.5,
 # linux-arm64 146.x.x.3), so bumping the wrapper is what moves Chromium.
-CLOAKBROWSER_WRAPPER_VERSION=0.5.7
+CLOAKBROWSER_WRAPPER_VERSION=0.5.10
 # Kimi WebBridge daemon + extension. No npm package; resolved from
 # cdn.kimi.com/webbridge/latest/version.json. Not consumed by any
 # build yet — Dockerfile.cloak starts baking it in #543.
-KIMI_WEBBRIDGE_VERSION=v1.11.5
+KIMI_WEBBRIDGE_VERSION=v1.11.6
 
 RUST_TOOLCHAINS=stable
 RUST_DEFAULT_TOOLCHAIN=stable