diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index b16161e96..35da8ea8a 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -20,7 +20,7 @@ jobs:
     # are reviewed too: the reusable workflow passes allow-bots: true to codex-action,
     # so its write-access check no longer aborts on the bot actor. Draft PRs are
     # skipped inside the reusable workflow.
-    uses: jitsucom/github-workflows/.github/workflows/ai-review.yml@1.30.20260821
+    uses: jitsucom/github-workflows/.github/workflows/ai-review.yml@1.32.20260826
     secrets:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       AI_CODE_REVIEW_APP_ID: ${{ secrets.AI_CODE_REVIEW_APP_ID }}
diff --git a/.github/workflows/security-fix.yml b/.github/workflows/security-fix.yml
index 3edca0269..2d76087f9 100644
--- a/.github/workflows/security-fix.yml
+++ b/.github/workflows/security-fix.yml
@@ -475,7 +475,7 @@ jobs:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           prompt-file: .github/codex/security-fix.prompt.md
           output-file: .github/codex/security-fix.output.md
-          model: gpt-5.3-codex
+          model: gpt-5.6-terra
           effort: high
           # Same CLI release as ai-review.yml in jitsucom/github-workflows —
           # verified clean with v1.11; keeps a CLI release from changing