diff --git a/CHANGELOG.md b/CHANGELOG.md
index 307f085..f9f1deb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Refresh bundled Cisco, Snyk, Socket, Claude Code, and Codex tools while retaining the existing Node.js and Python runtime floors and two-day dependency cooldown.
 - Preserve Docker sandbox paths containing commas or quotation marks without changing read-only or writable mount permissions. Thanks @SebTardif (#64).
 - Use one shared autoreview installation from `openclaw/agent-skills`; repository entrypoints now receive upstream fixes without copied helpers or test suites.
 
diff --git a/docker/clawscan-runtime/Dockerfile b/docker/clawscan-runtime/Dockerfile
index b00bd91..cff5fc8 100644
--- a/docker/clawscan-runtime/Dockerfile
+++ b/docker/clawscan-runtime/Dockerfile
@@ -2,12 +2,12 @@ FROM python:3.12-slim
 
 ARG SKILLSPECTOR_REF=69dcdfb74487d361ba4c811d088cfdea2ff3a9dc
 ARG AIG_SKILL_SCAN_VERSION=0.2.2
-ARG CISCO_AI_SKILL_SCANNER_VERSION=2.1.0
-ARG SNYK_AGENT_SCAN_VERSION=0.6.4
-ARG CLAUDE_CODE_VERSION=2.1.278
-ARG OPENAI_CODEX_VERSION=0.155.1
+ARG CISCO_AI_SKILL_SCANNER_VERSION=2.2.0
+ARG SNYK_AGENT_SCAN_VERSION=0.6.8
+ARG CLAUDE_CODE_VERSION=2.1.289
+ARG OPENAI_CODEX_VERSION=0.160.0
 ARG AGENTVERUS_SCANNER_VERSION=0.8.1
-ARG SOCKET_CLI_VERSION=1.1.176
+ARG SOCKET_CLI_VERSION=1.4.2
 
 ENV PATH="/root/.local/bin:${PATH}" \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \