diff --git a/.github/workflows/example-engine-network-permissions.lock.yml b/.github/workflows/example-engine-network-permissions.lock.yml
index 2dba6f898d..217f1cac61 100644
--- a/.github/workflows/example-engine-network-permissions.lock.yml
+++ b/.github/workflows/example-engine-network-permissions.lock.yml
@@ -146,7 +146,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/issue-triage.lock.yml b/.github/workflows/issue-triage.lock.yml
index eee44b9e71..e90a26bd5f 100644
--- a/.github/workflows/issue-triage.lock.yml
+++ b/.github/workflows/issue-triage.lock.yml
@@ -45,7 +45,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-add-issue-comment.lock.yml b/.github/workflows/test-claude-add-issue-comment.lock.yml
index 00895d7c71..74e6ca75a9 100644
--- a/.github/workflows/test-claude-add-issue-comment.lock.yml
+++ b/.github/workflows/test-claude-add-issue-comment.lock.yml
@@ -234,7 +234,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-add-issue-labels.lock.yml b/.github/workflows/test-claude-add-issue-labels.lock.yml
index 23451b3227..b0fcc0411a 100644
--- a/.github/workflows/test-claude-add-issue-labels.lock.yml
+++ b/.github/workflows/test-claude-add-issue-labels.lock.yml
@@ -234,7 +234,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-command.lock.yml b/.github/workflows/test-claude-command.lock.yml
index 61cb4cf19a..c5f2fa185c 100644
--- a/.github/workflows/test-claude-command.lock.yml
+++ b/.github/workflows/test-claude-command.lock.yml
@@ -472,7 +472,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-create-issue.lock.yml b/.github/workflows/test-claude-create-issue.lock.yml
index bd775ffd5d..6520e84d75 100644
--- a/.github/workflows/test-claude-create-issue.lock.yml
+++ b/.github/workflows/test-claude-create-issue.lock.yml
@@ -61,7 +61,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-create-pull-request.lock.yml b/.github/workflows/test-claude-create-pull-request.lock.yml
index d3dc1d6d68..7d1df245eb 100644
--- a/.github/workflows/test-claude-create-pull-request.lock.yml
+++ b/.github/workflows/test-claude-create-pull-request.lock.yml
@@ -61,7 +61,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-mcp.lock.yml b/.github/workflows/test-claude-mcp.lock.yml
index fdc5315892..0b94ec00c7 100644
--- a/.github/workflows/test-claude-mcp.lock.yml
+++ b/.github/workflows/test-claude-mcp.lock.yml
@@ -231,7 +231,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-push-to-branch.lock.yml b/.github/workflows/test-claude-push-to-branch.lock.yml
index 3ea2fd300b..ac54ae5482 100644
--- a/.github/workflows/test-claude-push-to-branch.lock.yml
+++ b/.github/workflows/test-claude-push-to-branch.lock.yml
@@ -111,7 +111,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-claude-update-issue.lock.yml b/.github/workflows/test-claude-update-issue.lock.yml
index 1157c27507..2b7d8ba694 100644
--- a/.github/workflows/test-claude-update-issue.lock.yml
+++ b/.github/workflows/test-claude-update-issue.lock.yml
@@ -234,7 +234,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-codex-add-issue-comment.lock.yml b/.github/workflows/test-codex-add-issue-comment.lock.yml
index da8a148254..0158fe8968 100644
--- a/.github/workflows/test-codex-add-issue-comment.lock.yml
+++ b/.github/workflows/test-codex-add-issue-comment.lock.yml
@@ -241,7 +241,7 @@ jobs:
             "--rm",
             "-e",
             "GITHUB_PERSONAL_ACCESS_TOKEN",
-            "ghcr.io/github/github-mcp-server:sha-45e90ae"
+            "ghcr.io/github/github-mcp-server:sha-09deac4"
           ]
           env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "${{ secrets.GITHUB_TOKEN }}" }
           EOF
diff --git a/.github/workflows/test-codex-add-issue-labels.lock.yml b/.github/workflows/test-codex-add-issue-labels.lock.yml
index a4618034ae..cbbd91370e 100644
--- a/.github/workflows/test-codex-add-issue-labels.lock.yml
+++ b/.github/workflows/test-codex-add-issue-labels.lock.yml
@@ -241,7 +241,7 @@ jobs:
             "--rm",
             "-e",
             "GITHUB_PERSONAL_ACCESS_TOKEN",
-            "ghcr.io/github/github-mcp-server:sha-45e90ae"
+            "ghcr.io/github/github-mcp-server:sha-09deac4"
           ]
           env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "${{ secrets.GITHUB_TOKEN }}" }
           EOF
diff --git a/.github/workflows/test-codex-command.lock.yml b/.github/workflows/test-codex-command.lock.yml
index 6ff932c72f..be0e7bca91 100644
--- a/.github/workflows/test-codex-command.lock.yml
+++ b/.github/workflows/test-codex-command.lock.yml
@@ -472,7 +472,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/test-codex-create-issue.lock.yml b/.github/workflows/test-codex-create-issue.lock.yml
index 2570f47854..73038ac2c3 100644
--- a/.github/workflows/test-codex-create-issue.lock.yml
+++ b/.github/workflows/test-codex-create-issue.lock.yml
@@ -68,7 +68,7 @@ jobs:
             "--rm",
             "-e",
             "GITHUB_PERSONAL_ACCESS_TOKEN",
-            "ghcr.io/github/github-mcp-server:sha-45e90ae"
+            "ghcr.io/github/github-mcp-server:sha-09deac4"
           ]
           env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "${{ secrets.GITHUB_TOKEN }}" }
           EOF
diff --git a/.github/workflows/test-codex-create-pull-request.lock.yml b/.github/workflows/test-codex-create-pull-request.lock.yml
index 502ae2845e..e03dd68e1f 100644
--- a/.github/workflows/test-codex-create-pull-request.lock.yml
+++ b/.github/workflows/test-codex-create-pull-request.lock.yml
@@ -68,7 +68,7 @@ jobs:
             "--rm",
             "-e",
             "GITHUB_PERSONAL_ACCESS_TOKEN",
-            "ghcr.io/github/github-mcp-server:sha-45e90ae"
+            "ghcr.io/github/github-mcp-server:sha-09deac4"
           ]
           env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "${{ secrets.GITHUB_TOKEN }}" }
           EOF
diff --git a/.github/workflows/test-codex-mcp.lock.yml b/.github/workflows/test-codex-mcp.lock.yml
index f5d971756d..4925e71674 100644
--- a/.github/workflows/test-codex-mcp.lock.yml
+++ b/.github/workflows/test-codex-mcp.lock.yml
@@ -238,7 +238,7 @@ jobs:
             "--rm",
             "-e",
             "GITHUB_PERSONAL_ACCESS_TOKEN",
-            "ghcr.io/github/github-mcp-server:sha-45e90ae"
+            "ghcr.io/github/github-mcp-server:sha-09deac4"
           ]
           env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "${{ secrets.GITHUB_TOKEN }}" }
           
diff --git a/.github/workflows/test-codex-push-to-branch.lock.yml b/.github/workflows/test-codex-push-to-branch.lock.yml
index 2d8440db84..52ba352726 100644
--- a/.github/workflows/test-codex-push-to-branch.lock.yml
+++ b/.github/workflows/test-codex-push-to-branch.lock.yml
@@ -118,7 +118,7 @@ jobs:
             "--rm",
             "-e",
             "GITHUB_PERSONAL_ACCESS_TOKEN",
-            "ghcr.io/github/github-mcp-server:sha-45e90ae"
+            "ghcr.io/github/github-mcp-server:sha-09deac4"
           ]
           env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "${{ secrets.GITHUB_TOKEN }}" }
           EOF
diff --git a/.github/workflows/test-codex-update-issue.lock.yml b/.github/workflows/test-codex-update-issue.lock.yml
index 9e6c76fcbe..ad4b0b64b4 100644
--- a/.github/workflows/test-codex-update-issue.lock.yml
+++ b/.github/workflows/test-codex-update-issue.lock.yml
@@ -241,7 +241,7 @@ jobs:
             "--rm",
             "-e",
             "GITHUB_PERSONAL_ACCESS_TOKEN",
-            "ghcr.io/github/github-mcp-server:sha-45e90ae"
+            "ghcr.io/github/github-mcp-server:sha-09deac4"
           ]
           env = { "GITHUB_PERSONAL_ACCESS_TOKEN" = "${{ secrets.GITHUB_TOKEN }}" }
           EOF
diff --git a/.github/workflows/test-proxy.lock.yml b/.github/workflows/test-proxy.lock.yml
index 7862e2149d..c212947c47 100644
--- a/.github/workflows/test-proxy.lock.yml
+++ b/.github/workflows/test-proxy.lock.yml
@@ -208,7 +208,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/weekly-research.lock.yml b/.github/workflows/weekly-research.lock.yml
index 2444c41e5f..731b3d98c4 100644
--- a/.github/workflows/weekly-research.lock.yml
+++ b/.github/workflows/weekly-research.lock.yml
@@ -44,7 +44,7 @@ jobs:
                   "--rm",
                   "-e",
                   "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
+                  "ghcr.io/github/github-mcp-server:sha-09deac4"
                 ],
                 "env": {
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
diff --git a/docs/mcps.md b/docs/mcps.md
index a1b93355b3..245b88fa05 100644
--- a/docs/mcps.md
+++ b/docs/mcps.md
@@ -139,11 +139,11 @@ You can configure the docker image version for GitHub tools:
 ```yaml
 tools:
   github:
-    docker_image_version: "sha-45e90ae"  # Optional: specify version
+    docker_image_version: "sha-09deac4"  # Optional: specify version
 ```
 
 **Configuration Options**:
-- `docker_image_version`: Docker image version (default: `"sha-45e90ae"`)
+- `docker_image_version`: Docker image version (default: `"sha-09deac4"`)
 
 ## Tool Allow-listing
 
diff --git a/pkg/parser/mcp.go b/pkg/parser/mcp.go
index 6396420440..edcd967e0b 100644
--- a/pkg/parser/mcp.go
+++ b/pkg/parser/mcp.go
@@ -83,7 +83,7 @@ func ExtractMCPConfigurations(frontmatter map[string]any, serverFilter string) (
 				Command: "docker",
 				Args: []string{
 					"run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
-					"ghcr.io/github/github-mcp-server:sha-45e90ae",
+					"ghcr.io/github/github-mcp-server:sha-09deac4",
 				},
 				Env: make(map[string]string),
 			}
diff --git a/pkg/parser/mcp_test.go b/pkg/parser/mcp_test.go
index a1be7de942..37f2415939 100644
--- a/pkg/parser/mcp_test.go
+++ b/pkg/parser/mcp_test.go
@@ -41,7 +41,7 @@ func TestExtractMCPConfigurations(t *testing.T) {
 					Command: "docker",
 					Args: []string{
 						"run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
-						"ghcr.io/github/github-mcp-server:sha-45e90ae",
+						"ghcr.io/github/github-mcp-server:sha-09deac4",
 					},
 					Env:     map[string]string{"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN_REQUIRED}"},
 					Allowed: []string{},
@@ -202,7 +202,7 @@ func TestExtractMCPConfigurations(t *testing.T) {
 					Command: "docker",
 					Args: []string{
 						"run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
-						"ghcr.io/github/github-mcp-server:sha-45e90ae",
+						"ghcr.io/github/github-mcp-server:sha-09deac4",
 					},
 					Env:     map[string]string{"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN_REQUIRED}"},
 					Allowed: []string{},
diff --git a/pkg/workflow/compiler.go b/pkg/workflow/compiler.go
index f618b2235f..1f5190d643 100644
--- a/pkg/workflow/compiler.go
+++ b/pkg/workflow/compiler.go
@@ -2249,7 +2249,7 @@ func (c *Compiler) generateMCPSetup(yaml *strings.Builder, tools map[string]any,
 }
 
 func getGitHubDockerImageVersion(githubTool any) string {
-	githubDockerImageVersion := "sha-45e90ae" // Default Docker image version
+	githubDockerImageVersion := "sha-09deac4" // Default Docker image version
 	// Extract docker_image_version setting from tool properties
 	if toolConfig, ok := githubTool.(map[string]any); ok {
 		if versionSetting, exists := toolConfig["docker_image_version"]; exists {
diff --git a/pkg/workflow/mcp_config_test.go b/pkg/workflow/mcp_config_test.go
index 74d1835a5f..c71e261928 100644
--- a/pkg/workflow/mcp_config_test.go
+++ b/pkg/workflow/mcp_config_test.go
@@ -35,7 +35,7 @@ tools:
 			// With Docker MCP always enabled, default is docker (not services)
 			expectedType:        "docker",
 			expectedCommand:     "docker",
-			expectedDockerImage: "ghcr.io/github/github-mcp-server:sha-45e90ae",
+			expectedDockerImage: "ghcr.io/github/github-mcp-server:sha-09deac4",
 		},
 		{
 			name: "custom docker image version",
@@ -205,7 +205,7 @@ func TestGenerateGitHubMCPConfig(t *testing.T) {
 				if !strings.Contains(result, `"command": "docker"`) {
 					t.Errorf("Expected Docker command but got:\n%s", result)
 				}
-				if !strings.Contains(result, `"ghcr.io/github/github-mcp-server:sha-45e90ae"`) {
+				if !strings.Contains(result, `"ghcr.io/github/github-mcp-server:sha-09deac4"`) {
 					t.Errorf("Expected Docker image but got:\n%s", result)
 				}
 				if strings.Contains(result, `"type": "http"`) {
@@ -288,7 +288,7 @@ tools:
       args: ["run", "-i", "--rm", "custom/mcp-server:latest"]
 ---`,
 			expectedType:        "docker",      // GitHub always uses docker now
-			expectedDockerImage: "sha-45e90ae", // Default version
+			expectedDockerImage: "sha-09deac4", // Default version
 		},
 		{
 			name: "custom docker MCP with default settings",
@@ -303,7 +303,7 @@ tools:
       args: ["run", "-i", "--rm", "custom/mcp-server:latest"]
 ---`,
 			expectedType:        "docker",      // Services mode removed - always Docker
-			expectedDockerImage: "sha-45e90ae", // Default version
+			expectedDockerImage: "sha-09deac4", // Default version
 		},
 		{
 			name: "custom docker MCP with different settings",
@@ -318,7 +318,7 @@ tools:
       args: ["run", "-i", "--rm", "custom/mcp-server:latest"]
 ---`,
 			expectedType:        "docker",
-			expectedDockerImage: "sha-45e90ae", // Default version
+			expectedDockerImage: "sha-09deac4", // Default version
 		},
 		{
 			name: "mixed MCP configuration with defaults",
@@ -338,7 +338,7 @@ tools:
       args: ["run", "-i", "--rm", "-v", "/tmp:/workspace", "custom/tool:latest"]
 ---`,
 			expectedType:        "docker",      // GitHub should now use docker by default (not services)
-			expectedDockerImage: "sha-45e90ae", // Default version
+			expectedDockerImage: "sha-09deac4", // Default version
 		},
 		{
 			name: "custom docker MCP with custom Docker image version",