diff --git a/base/scripts/install-awscli.sh b/base/scripts/install-awscli.sh
index 2514e5e4..c47cc4b4 100644
--- a/base/scripts/install-awscli.sh
+++ b/base/scripts/install-awscli.sh
@@ -2,7 +2,7 @@
 set -e
 
 # renovate: datasource=github-tags depName=aws/aws-cli
-AWS_CLI_VERSION="2.37.4"
+AWS_CLI_VERSION="2.37.9"
 
 # Download the official archive and its PGP signature
 AWS_CLI_ZIP="awscli-exe-linux-x86_64-${AWS_CLI_VERSION}.zip"
diff --git a/base/scripts/install-duckdb-cli.sh b/base/scripts/install-duckdb-cli.sh
index 840e4677..c59f3948 100755
--- a/base/scripts/install-duckdb-cli.sh
+++ b/base/scripts/install-duckdb-cli.sh
@@ -2,7 +2,7 @@
 set -eo pipefail
 
 # renovate: datasource=github-releases depName=duckdb/duckdb
-DUCKDB_VERSION="1.5.5"
+DUCKDB_VERSION="1.5.6"
 
 # Download the GitHub archive and verify its checksum
 DUCKDB_ZIP="duckdb_cli-linux-amd64.zip"
diff --git a/base/scripts/install-opencode.sh b/base/scripts/install-opencode.sh
index a9661413..c5c4168a 100644
--- a/base/scripts/install-opencode.sh
+++ b/base/scripts/install-opencode.sh
@@ -2,7 +2,7 @@
 set -eo pipefail
 
 # renovate: datasource=github-releases depName=anomalyco/opencode
-OPENCODE_VERSION="1.18.33"
+OPENCODE_VERSION="1.18.34"
 
 # Download the GitHub archive and verify its checksum
 OPENCODE_ARCHIVE="opencode-linux-x64.tar.gz"
diff --git a/vscode/scripts/install-vscode.sh b/vscode/scripts/install-vscode.sh
index b2864432..61efffe7 100755
--- a/vscode/scripts/install-vscode.sh
+++ b/vscode/scripts/install-vscode.sh
@@ -2,7 +2,7 @@
 set -eo pipefail
 
 # renovate: datasource=github-releases depName=coder/code-server
-CODE_SERVER_VERSION="4.139.1"
+CODE_SERVER_VERSION="4.140.0"
 
 # Download the official package and verify its checksum
 CODE_SERVER_DEB="code-server_${CODE_SERVER_VERSION}_amd64.deb"