diff --git a/backend/onyx/server/features/build/sandbox/image/Dockerfile b/backend/onyx/server/features/build/sandbox/image/Dockerfile
index 741a48f5ecc..1eaa9ce8bfb 100644
--- a/backend/onyx/server/features/build/sandbox/image/Dockerfile
+++ b/backend/onyx/server/features/build/sandbox/image/Dockerfile
@@ -48,7 +48,7 @@ FROM ${BASE_IMAGE_REGISTRY}/library/python:3.13-slim@sha256:f82c96458eedc847b233
 # the image.
 ARG ENABLE_SKILLS=true
 ARG ENABLE_BROWSER=true
-ARG OPENCODE_VERSION=1.18.13
+ARG OPENCODE_VERSION=1.18.19
 ARG AGENT_BROWSER_VERSION=0.31.1
 
 # firewall-init.sh needs: iptables (egress lockdown), ca-certificates (trust
diff --git a/docs/craft/sandbox/image-and-spinup.md b/docs/craft/sandbox/image-and-spinup.md
index d9a1b39c43d..c31a88a7204 100644
--- a/docs/craft/sandbox/image-and-spinup.md
+++ b/docs/craft/sandbox/image-and-spinup.md
@@ -57,7 +57,7 @@ installs opencode via its own install script with the `--version` flag
 so the build is at least reproducible:
 
 ```dockerfile
-ARG OPENCODE_VERSION=1.18.13
+ARG OPENCODE_VERSION=1.18.19
 RUN curl -fsSL https://opencode.ai/install \
     | bash -s -- --version "${OPENCODE_VERSION}" --no-modify-path
 ```