diff --git a/src/Dockerfile b/src/Dockerfile
index fd60ca9443..e1e0be8c29 100644
--- a/src/Dockerfile
+++ b/src/Dockerfile
@@ -324,7 +324,7 @@ RUN timeout 120s npm install -g --ignore-scripts --no-fund --no-audit \
 # dashboard's codex model discovery (`codex app-server` model/list — pure
 # local stdio, no network, unaffected by the proxy CA) falls back to the
 # static list, and non-codex backends are unaffected.
-ARG CODEX_VERSION=0.167.0
+ARG CODEX_VERSION=0.168.0
 ARG CLINE_VERSION=3.0.74
 # npm can briefly advertise AWS SDK versions before all registry replicas serve
 # them. Wait at most three minutes between attempts and revalidate metadata.
diff --git a/src/Dockerfile.contributor b/src/Dockerfile.contributor
index 3e6703fdf8..8c19ceeb38 100644
--- a/src/Dockerfile.contributor
+++ b/src/Dockerfile.contributor
@@ -262,7 +262,7 @@ ARG KILO_CLI_VERSION=7.5.6
 # Same ARG name and value as src/Dockerfile so bin/test_backend_smoke.sh can
 # assert the two pins agree — this line was previously an inline hardcode that
 # could (and did) drift from the main image's CODEX_VERSION unnoticed.
-ARG CODEX_VERSION=0.167.0
+ARG CODEX_VERSION=0.168.0
 RUN npm install -g --ignore-scripts --no-fund --no-audit \
     @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \
     @github/copilot@${COPILOT_VERSION} \