diff --git a/docs/src/content/docs/nebi-integration.md b/docs/src/content/docs/nebi-integration.md
index 2223cc8..24fd65c 100644
--- a/docs/src/content/docs/nebi-integration.md
+++ b/docs/src/content/docs/nebi-integration.md
@@ -70,7 +70,7 @@ That means the Nebi version is a deploy-time decision:
 nebi:
   image:
     repository: quay.io/nebari/nebi
-    tag: "sha-bd25921"
+    tag: "sha-5ca877a"
     pullPolicy: IfNotPresent
 ```
 
diff --git a/docs/src/content/docs/values-reference.md b/docs/src/content/docs/values-reference.md
index 0e1b61d..2b03f3f 100644
--- a/docs/src/content/docs/values-reference.md
+++ b/docs/src/content/docs/values-reference.md
@@ -142,7 +142,7 @@ Admin guide: [Nebi integration](/nebi-integration/).
 | Field | Default | What it does |
 |---|---|---|
 | `nebi.image.repository` | `quay.io/nebari/nebi` | Binary copied into user pods by an init container. |
-| `nebi.image.tag` | `sha-bd25921` | Pinned per chart release. Empty disables the init container. |
+| `nebi.image.tag` | `sha-5ca877a` | Pinned per chart release. Empty disables the init container. |
 | `nebi.image.pullPolicy` | `IfNotPresent` | — |
 | `nebi.remoteURL` | `""` *(derived)* | Browser-facing Nebi URL, used for the OIDC redirect. |
 | `nebi.internalURL` | `""` *(derived)* | In-cluster URL for the token-exchange path. |
diff --git a/images/Dockerfile b/images/Dockerfile
index 721aa33..daf859c 100644
--- a/images/Dockerfile
+++ b/images/Dockerfile
@@ -113,7 +113,7 @@ FROM ${NEBI_IMAGE:-scratch} AS nebi-source
 # ========== jupyterlab (base + nebi) ===========
 FROM jupyterlab-base AS jupyterlab
 
-ARG NEBI_VERSION=0.12-rc3
+ARG NEBI_VERSION=0.15
 ARG TARGETARCH
 
 # Install nebi: copy from NEBI_IMAGE if provided, else download from GitHub release.
diff --git a/values.yaml b/values.yaml
index de2f7ce..3061996 100644
--- a/values.yaml
+++ b/values.yaml
@@ -252,8 +252,8 @@ nebi:
     # Pinned manually per chart release (scripts/bump_image_tags.py only
     # handles the jupyterlab images); deployers can override to test a PR
     # build or roll forward. Leave non-empty so the init container is wired
-    # by default. sha-bd25921 == the nebi v0.14 tag commit.
-    tag: "sha-bd25921"
+    # by default. sha-5ca877a == the nebi v0.15 tag commit.
+    tag: "sha-5ca877a"
     pullPolicy: IfNotPresent
   # External Nebi FQDN (browser-side, used for OIDC redirect).
   # If empty, derived from keycloak.hostname as