diff --git a/.gitea/workflows/refresh-image-locks.yml b/.gitea/workflows/refresh-image-locks.yml
new file mode 100644
index 00000000..f92d3200
--- /dev/null
+++ b/.gitea/workflows/refresh-image-locks.yml
@@ -0,0 +1,57 @@
+# Manually refresh the committed package locks and the pinned Codex installer
+# checksum after deliberately changing a direct version in the source files.
+#
+# The job uploads the generated files for review; it never commits or pushes.
+
+name: refresh-image-locks
+
+on:
+  workflow_dispatch:
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compile gateway Python lock
+        run: |
+          python3 -m pip install --break-system-packages pip-tools==7.5.1
+          python3 -m piptools compile \
+            --generate-hashes \
+            --output-file requirements.gateway.lock \
+            requirements.gateway.in
+
+      - name: Resolve provider npm locks
+        run: |
+          for provider in claude pi; do
+            (
+              cd "bot_bottle/contrib/$provider"
+              npm install --package-lock-only --ignore-scripts --no-audit --no-fund
+            )
+          done
+
+      - name: Refresh pinned Codex installer checksum
+        run: |
+          CODEX_VERSION=$(
+            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
+          )
+          test -n "$CODEX_VERSION"
+          curl -fsSL \
+            "https://raw.githubusercontent.com/openai/codex/rust-v${CODEX_VERSION}/scripts/install/install.sh" \
+            -o bot_bottle/contrib/codex/install.sh
+          (
+            cd bot_bottle/contrib/codex
+            sha256sum install.sh > install.sh.sha256
+          )
+
+      - name: Upload refreshed inputs
+        uses: actions/upload-artifact@v3
+        with:
+          name: image-input-locks
+          path: |
+            requirements.gateway.lock
+            bot_bottle/contrib/claude/package-lock.json
+            bot_bottle/contrib/pi/package-lock.json
+            bot_bottle/contrib/codex/install.sh.sha256
diff --git a/bot_bottle/contrib/claude/package.json b/bot_bottle/contrib/claude/package.json
new file mode 100644
index 00000000..021edc7e
--- /dev/null
+++ b/bot_bottle/contrib/claude/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "bot-bottle-claude-image",
+  "private": true,
+  "dependencies": {
+    "@anthropic-ai/claude-code": "2.1.172"
+  }
+}
diff --git a/bot_bottle/contrib/codex/Dockerfile b/bot_bottle/contrib/codex/Dockerfile
index 9f29188b..95160427 100644
--- a/bot_bottle/contrib/codex/Dockerfile
+++ b/bot_bottle/contrib/codex/Dockerfile
@@ -5,6 +5,11 @@
 
 FROM node:22-trixie-slim
 
+# The standalone installer is used below because remote-control requires its
+# managed package layout. Keep this exact release in sync with the verified
+# installer source and checksum.
+ARG CODEX_VERSION=0.145.0
+
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
diff --git a/bot_bottle/contrib/pi/package.json b/bot_bottle/contrib/pi/package.json
new file mode 100644
index 00000000..d0c4d375
--- /dev/null
+++ b/bot_bottle/contrib/pi/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "bot-bottle-pi-image",
+  "private": true,
+  "dependencies": {
+    "@earendil-works/pi-coding-agent": "0.81.1",
+    "@harms-haus/pi-cwd": "1.0.0",
+    "context-mode": "1.0.169",
+    "pi-mcp-adapter": "2.11.0",
+    "pi-subagents": "0.35.1",
+    "pi-web-access": "0.13.0"
+  }
+}
diff --git a/requirements.gateway.in b/requirements.gateway.in
new file mode 100644
index 00000000..dfc513e3
--- /dev/null
+++ b/requirements.gateway.in
@@ -0,0 +1,5 @@
+# Runtime-only third-party dependency for Dockerfile.gateway.
+#
+# Regenerate requirements.gateway.lock with the image-input refresh workflow;
+# Dockerfile.gateway installs the lock with --require-hashes.
+mitmproxy==11.1.3