diff --git a/README.md b/README.md
index 7263a30..b7430d4 100644
--- a/README.md
+++ b/README.md
@@ -49,7 +49,7 @@ Authenticate via device auth and store the resulting `auth.json` as a secret. Th
 1. Pull the codex-docker image:
 
    ```bash
-   docker pull ghcr.io/icoretech/codex-docker:0.115.0
+   docker pull ghcr.io/icoretech/codex-docker:0.130.0
    ```
 
 2. Run the device auth flow (the `codex-bootstrap` helper forces file-based credential storage, which is required for CI):
@@ -58,7 +58,7 @@ Authenticate via device auth and store the resulting `auth.json` as a secret. Th
    mkdir -p .codex
    docker run --rm -it \
      -v "$PWD/.codex:/home/codex/.codex" \
-     ghcr.io/icoretech/codex-docker:0.115.0 \
+     ghcr.io/icoretech/codex-docker:0.130.0 \
      codex-bootstrap device-auth
    ```
 
@@ -145,7 +145,7 @@ You can pass a base64-encoded `config.toml` to customize Codex behavior (model d
 | `openai_api_key` | No | `""` | OpenAI API key. Mutually exclusive with `codex_config`. |
 | `codex_config` | No | `""` | Base64-encoded `auth.json` from a prior device-auth session. Mutually exclusive with `openai_api_key`. |
 | `codex_config_toml` | No | `""` | Base64-encoded `config.toml` with Codex preferences (model, personality, etc.). Works with either auth method. |
-| `image_version` | No | `0.115.0` | codex-docker image version tag used for the container. |
+| `image_version` | No | `0.130.0` | codex-docker image version tag used for the container. |
 | `model` | No | `""` | Model override passed to `codex exec --model`. When omitted, the model configured in your Codex config is used. |
 | `reasoning_effort` | No | `""` | Reasoning effort level (`minimal`, `low`, `medium`, `high`, `xhigh`). Passed as `model_reasoning_effort` config override. |
 | `network_access` | No | `false` | Allow Codex to make network requests (`curl`, `wget`, etc.) during execution. When `false`, a prompt-level policy instructs the model not to use networking tools. |
diff --git a/action.yml b/action.yml
index 0af1166..b710507 100644
--- a/action.yml
+++ b/action.yml
@@ -30,7 +30,7 @@ inputs:
     description: 'codex-docker image version tag'
     required: false
     # renovate: datasource=docker depName=ghcr.io/icoretech/codex-docker
-    default: '0.115.0'
+    default: '0.130.0'
   model:
     description: 'Model override (passed to codex exec --model)'
     required: false
diff --git a/entrypoint.sh b/entrypoint.sh
index e2ca7f4..f5bfc2d 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -51,7 +51,7 @@ openai_api_key="${INPUT_OPENAI_API_KEY:-}"
 codex_config="${INPUT_CODEX_CONFIG:-}"
 codex_config_toml="${INPUT_CODEX_CONFIG_TOML:-}"
 # renovate: datasource=docker depName=ghcr.io/icoretech/codex-docker
-image_version="${INPUT_IMAGE_VERSION:-0.115.0}"
+image_version="${INPUT_IMAGE_VERSION:-0.130.0}"
 model="${INPUT_MODEL:-}"
 reasoning_effort="${INPUT_REASONING_EFFORT:-}"
 network_access="${INPUT_NETWORK_ACCESS:-false}"