diff --git a/crates/aionui-session/src/backend/cli_version.rs b/crates/aionui-session/src/backend/cli_version.rs
index 1126876cf..b8f8cf545 100644
--- a/crates/aionui-session/src/backend/cli_version.rs
+++ b/crates/aionui-session/src/backend/cli_version.rs
@@ -37,8 +37,8 @@ use crate::event::{LocalizedText, NoticeLevel};
 /// on does complete turns and passes the suite, so the gate walks forward over
 /// 0.147.0 and leaves it unverified rather than a floor anyone can install into.
 pub const VERIFIED_CLAUDE_VERSION: &str = "2.1.235";
-pub const VERIFIED_CODEX_VERSION: &str = "0.149.1";
-pub const VERIFIED_AGY_VERSION: &str = "1.1.20";
+pub const VERIFIED_CODEX_VERSION: &str = "0.150.1";
+pub const VERIFIED_AGY_VERSION: &str = "1.1.22";
 
 /// The verified release for a direct-CLI backend, keyed by the program name the
 /// backend spawns. `None` for anything not version-gated here.
@@ -456,10 +456,10 @@ mod tests {
 
     #[test]
     fn components_compare_numerically_not_lexically() {
-        // The bug a string compare would introduce: "0.149.1" < "0.99.0"
-        // lexically, but 149 > 99.
+        // The bug a string compare would introduce: "0.150.1" < "0.99.0"
+        // lexically, but 150 > 99.
         assert_eq!(classify("0.99.0", VERIFIED_CODEX_VERSION), VersionVerdict::Older);
-        assert_eq!(classify("0.149.2", VERIFIED_CODEX_VERSION), VersionVerdict::Newer);
+        assert_eq!(classify("0.150.2", VERIFIED_CODEX_VERSION), VersionVerdict::Newer);
     }
 
     #[test]
@@ -475,13 +475,13 @@ mod tests {
         // The literal the other two CLIs already pin, which agy was missing: a
         // user on exactly the verified release is told nothing, and a bump that
         // lands without re-verifying against that exact binary breaks here.
-        assert_eq!(classify("1.1.20", VERIFIED_AGY_VERSION), VersionVerdict::Verified);
-        assert!(drift_notice("agy", "1.1.20", VERIFIED_AGY_VERSION).is_none());
+        assert_eq!(classify("1.1.22", VERIFIED_AGY_VERSION), VersionVerdict::Verified);
+        assert!(drift_notice("agy", "1.1.22", VERIFIED_AGY_VERSION).is_none());
 
         // agy prints a bare version, so the older/newer paths are worth pinning
         // on that exact shape rather than only on a decorated one.
-        assert_eq!(classify("1.1.19", VERIFIED_AGY_VERSION), VersionVerdict::Older);
-        assert_eq!(classify("1.1.21", VERIFIED_AGY_VERSION), VersionVerdict::Newer);
+        assert_eq!(classify("1.1.21", VERIFIED_AGY_VERSION), VersionVerdict::Older);
+        assert_eq!(classify("1.1.23", VERIFIED_AGY_VERSION), VersionVerdict::Newer);
     }
 
     /// Both drift directions are `Info` — the tier the frontend draws as a quiet
@@ -568,9 +568,9 @@ mod tests {
     fn local_codex_output_is_classified_as_newer() {
         // Real `codex --version` output shape, one release above the verified
         // one so the newer path is what gets exercised.
-        assert_eq!(parse_version("codex-cli 0.150.0"), Some(vec![0, 150, 0]));
-        let (level, _, localized) = drift_notice("codex", "codex-cli 0.150.0", VERIFIED_CODEX_VERSION)
-            .expect("0.150.0 drifts from the verified release");
+        assert_eq!(parse_version("codex-cli 0.151.0"), Some(vec![0, 151, 0]));
+        let (level, _, localized) = drift_notice("codex", "codex-cli 0.151.0", VERIFIED_CODEX_VERSION)
+            .expect("0.151.0 drifts from the verified release");
         assert_eq!(level, NoticeLevel::Info);
         assert_eq!(localized.code, CODE_CLI_VERSION_NEWER);
 
@@ -578,10 +578,10 @@ mod tests {
         // verified release is told nothing, and this breaks if a bump lands
         // without re-verifying against that exact binary.
         assert_eq!(
-            classify("codex-cli 0.149.1", VERIFIED_CODEX_VERSION),
+            classify("codex-cli 0.150.1", VERIFIED_CODEX_VERSION),
             VersionVerdict::Verified
         );
-        assert!(drift_notice("codex", "codex-cli 0.149.1", VERIFIED_CODEX_VERSION).is_none());
+        assert!(drift_notice("codex", "codex-cli 0.150.1", VERIFIED_CODEX_VERSION).is_none());
     }
 
     #[test]