diff --git a/.woodpecker/ci-scripts-test.yml b/.woodpecker/ci-scripts-test.yml
index 7afcb616..3154a340 100644
--- a/.woodpecker/ci-scripts-test.yml
+++ b/.woodpecker/ci-scripts-test.yml
@@ -35,25 +35,25 @@ when:
 steps:
   - name: model-selection-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.312
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
     commands:
       - sh scripts/ci/test-model-selection.sh
 
   - name: pr-review-mistral-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.312
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
     commands:
       - sh scripts/ci/test-pr-review-mistral.sh
 
   - name: promtool-rules-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.312
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
     commands:
       - sh scripts/ci/test-promtool-rules.sh
 
   - name: yaml-citations-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.312
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
     commands:
       - sh scripts/ci/test-yaml-citations.sh
 
diff --git a/.woodpecker/e2e.yml b/.woodpecker/e2e.yml
index 31a95a2e..f49455ac 100644
--- a/.woodpecker/e2e.yml
+++ b/.woodpecker/e2e.yml
@@ -26,7 +26,7 @@ steps:
     # fetch-models.sh response mapping. No cluster, no secrets, no network — the
     # ci-claude image just provides sh + jq. Keeps the flag-injection regression
     # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.312
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
     commands:
       - sh scripts/ci/test-model-selection.sh
 
diff --git a/.woodpecker/security-scan.yml b/.woodpecker/security-scan.yml
index 48e93cf7..46b7e40e 100644
--- a/.woodpecker/security-scan.yml
+++ b/.woodpecker/security-scan.yml
@@ -70,7 +70,7 @@ steps:
     # this step is skipped — otherwise we'd fork-bomb PRs.
     when:
       - branch: main
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.312
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token
diff --git a/.woodpecker/update-audit.yml b/.woodpecker/update-audit.yml
index ffbc03e9..dd9ea68e 100644
--- a/.woodpecker/update-audit.yml
+++ b/.woodpecker/update-audit.yml
@@ -30,7 +30,7 @@ when:
 
 steps:
   - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.312
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token