diff --git a/Dockerfile.dockerfile b/Dockerfile.dockerfile
index e6c21ee..8c7ed9a 100644
--- a/Dockerfile.dockerfile
+++ b/Dockerfile.dockerfile
@@ -130,8 +130,8 @@ RUN curl -fsSL https://nodejs.org/dist/v24.16.0/node-v24.16.0-linux-x64.tar.xz \
 # shadowed by the Tier 2/3 bind-mounted volumes. Agent CLIs (Tier 2) are
 # intentionally NOT baked here — see managed-tools/manifest.json.
 RUN ONNXRUNTIME_NODE_INSTALL=skip npm install -g --prefix /opt/paseo \
-      @getpaseo/cli@0.8.0 \
-      @getpaseo/server@0.8.0 \
+      @getpaseo/cli@0.10.2 \
+      @getpaseo/server@0.10.2 \
     && npm cache clean --force
 
 # ── User setup ──────────────────────────────────────────────────────
diff --git a/managed-tools/baked-tools.json b/managed-tools/baked-tools.json
index 9c24b9a..23d5a5c 100644
--- a/managed-tools/baked-tools.json
+++ b/managed-tools/baked-tools.json
@@ -59,13 +59,13 @@
     },
     {
       "name": "docker",
-      "currentVersion": "29.8.0",
+      "currentVersion": "29.8.1",
       "versionCommand": "docker --version",
       "versionPattern": "^Docker version [0-9]+\\.[0-9]+\\.[0-9]+",
       "installedPath": "/usr/local/bin/docker",
       "sourceType": "base-image",
       "sourceUrl": "https://hub.docker.com/_/docker/tags",
-      "sourceDetail": "COPY --from=docker-dind (FROM docker:29.8.0-dind stage) \u2014 Dependabot docker monitors FROM image tags",
+      "sourceDetail": "COPY --from=docker-dind (FROM docker:29.8.1-dind stage) \u2014 Dependabot docker monitors FROM image tags",
       "monitorType": "dependabot",
       "dependabotEcosystem": "docker",
       "updateImpact": "rebuild-image-required",
@@ -75,13 +75,13 @@
     },
     {
       "name": "dockerd",
-      "currentVersion": "29.8.0",
+      "currentVersion": "29.8.1",
       "versionCommand": "dockerd --version",
       "versionPattern": "^dockerd [0-9]+\\.[0-9]+\\.[0-9]+",
       "installedPath": "/usr/local/bin/dockerd",
       "sourceType": "base-image",
       "sourceUrl": "https://hub.docker.com/_/docker/tags",
-      "sourceDetail": "COPY --from=docker-dind (FROM docker:29.8.0-dind stage) \u2014 same image as docker CLI",
+      "sourceDetail": "COPY --from=docker-dind (FROM docker:29.8.1-dind stage) \u2014 same image as docker CLI",
       "monitorType": "dependabot",
       "dependabotEcosystem": "docker",
       "updateImpact": "rebuild-image-required",
@@ -202,7 +202,7 @@
     },
     {
       "name": "paseo",
-      "currentVersion": "0.8.0",
+      "currentVersion": "0.10.2",
       "versionCommand": "paseo --version",
       "versionPattern": "^[0-9]+\\.[0-9]+\\.[0-9]+",
       "installedPath": "/opt/paseo/bin/paseo",
diff --git a/managed-tools/manifest.json b/managed-tools/manifest.json
index 37d5b1c..7a5c886 100644
--- a/managed-tools/manifest.json
+++ b/managed-tools/manifest.json
@@ -52,7 +52,7 @@
         {
           "name": "pi",
           "pkg": "@earendil-works/pi-coding-agent",
-          "version": "0.87.1"
+          "version": "1.0.0"
         },
         {
           "name": "opencode",