diff --git a/tool/versions.env b/tool/versions.env
index 9588f80..854520f 100644
--- a/tool/versions.env
+++ b/tool/versions.env
@@ -6,4 +6,4 @@
 # pub global activate` resolves it from pub.dev (own integrity), so no sha is
 # tracked. Keep at pub.dev's LATEST: the gate must run the same pana pub.dev
 # runs, or it drifts from the verdict it exists to predict.
-PANA_VERSION="0.23.14"
+PANA_VERSION="0.23.18"