diff --git a/pkg/cli/workflows/example-blocked-domains.lock.yml b/pkg/cli/workflows/example-blocked-domains.lock.yml
index c3aea58695c..219279676c8 100644
--- a/pkg/cli/workflows/example-blocked-domains.lock.yml
+++ b/pkg/cli/workflows/example-blocked-domains.lock.yml
@@ -136,7 +136,7 @@ jobs:
             const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
             await determineAutomaticLockdown(github, context, core);
       - name: Download container images
-        run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-mcpg:v0.0.98 ghcr.io/github/github-mcp-server:v0.30.3
+        run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-mcpg:v0.0.98 ghcr.io/github/github-mcp-server:v0.31.0
       - name: Start MCP gateway
         id: start-mcp-gateway
         env:
@@ -165,7 +165,7 @@ jobs:
             "mcpServers": {
               "github": {
                 "type": "stdio",
-                "container": "ghcr.io/github/github-mcp-server:v0.30.3",
+                "container": "ghcr.io/github/github-mcp-server:v0.31.0",
                 "env": {
                   "GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
diff --git a/pkg/workflow/codex_engine_test.go b/pkg/workflow/codex_engine_test.go
index 5d21f7fa473..21b85d3d6da 100644
--- a/pkg/workflow/codex_engine_test.go
+++ b/pkg/workflow/codex_engine_test.go
@@ -308,7 +308,7 @@ func TestCodexEngineRenderMCPConfig(t *testing.T) {
 				"user_agent = \"test-workflow\"",
 				"startup_timeout_sec = 120",
 				"tool_timeout_sec = 60",
-				"container = \"ghcr.io/github/github-mcp-server:v0.30.3\"",
+				"container = \"ghcr.io/github/github-mcp-server:v0.31.0\"",
 				"env = { \"GITHUB_PERSONAL_ACCESS_TOKEN\" = \"$GH_AW_GITHUB_TOKEN\", \"GITHUB_READ_ONLY\" = \"1\", \"GITHUB_TOOLSETS\" = \"context,repos,issues,pull_requests\" }",
 				"env_vars = [\"GITHUB_PERSONAL_ACCESS_TOKEN\", \"GITHUB_READ_ONLY\", \"GITHUB_TOOLSETS\"]",
 				"GH_AW_MCP_CONFIG_EOF",
@@ -318,7 +318,7 @@ func TestCodexEngineRenderMCPConfig(t *testing.T) {
 				"{",
 				"\"mcpServers\": {",
 				"\"github\": {",
-				"\"container\": \"ghcr.io/github/github-mcp-server:v0.30.3\",",
+				"\"container\": \"ghcr.io/github/github-mcp-server:v0.31.0\",",
 				"\"env\": {",
 				"\"GITHUB_LOCKDOWN_MODE\": \"$GITHUB_MCP_LOCKDOWN\",",
 				"\"GITHUB_PERSONAL_ACCESS_TOKEN\": \"$GITHUB_MCP_SERVER_TOKEN\",",
diff --git a/pkg/workflow/copilot_engine_test.go b/pkg/workflow/copilot_engine_test.go
index 3bf67ac5b77..cd453f8a2cc 100644
--- a/pkg/workflow/copilot_engine_test.go
+++ b/pkg/workflow/copilot_engine_test.go
@@ -722,7 +722,7 @@ func TestCopilotEngineRenderGitHubMCPConfig(t *testing.T) {
 			expectedStrs: []string{
 				`"github": {`,
 				`"type": "stdio",`,
-				`"container": "ghcr.io/github/github-mcp-server:v0.30.3"`,
+				`"container": "ghcr.io/github/github-mcp-server:v0.31.0"`,
 				`"env": {`,
 				`"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}"`,
 				`},`,
@@ -752,7 +752,7 @@ func TestCopilotEngineRenderGitHubMCPConfig(t *testing.T) {
 			expectedStrs: []string{
 				`"github": {`,
 				`"type": "stdio",`,
-				`"container": "ghcr.io/github/github-mcp-server:v0.30.3"`,
+				`"container": "ghcr.io/github/github-mcp-server:v0.31.0"`,
 				`"env": {`,
 				`}`,
 			},
diff --git a/pkg/workflow/copilot_github_mcp_test.go b/pkg/workflow/copilot_github_mcp_test.go
index 387351aab40..edd9466144a 100644
--- a/pkg/workflow/copilot_github_mcp_test.go
+++ b/pkg/workflow/copilot_github_mcp_test.go
@@ -24,7 +24,7 @@ func TestRenderGitHubCopilotMCPConfig_AllowedTools(t *testing.T) {
 			expectedContent: []string{
 				`"github": {`,
 				`"type": "stdio"`,
-				`"container": "ghcr.io/github/github-mcp-server:v0.30.3"`,
+				`"container": "ghcr.io/github/github-mcp-server:v0.31.0"`,
 				`"env": {`,
 				`"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}"`,
 			},
@@ -37,7 +37,7 @@ func TestRenderGitHubCopilotMCPConfig_AllowedTools(t *testing.T) {
 			expectedContent: []string{
 				`"github": {`,
 				`"type": "stdio"`,
-				`"container": "ghcr.io/github/github-mcp-server:v0.30.3"`,
+				`"container": "ghcr.io/github/github-mcp-server:v0.31.0"`,
 				`"env": {`,
 			},
 			unexpectedContent: []string{},
@@ -51,7 +51,7 @@ func TestRenderGitHubCopilotMCPConfig_AllowedTools(t *testing.T) {
 			expectedContent: []string{
 				`"github": {`,
 				`"type": "stdio"`,
-				`"container": "ghcr.io/github/github-mcp-server:v0.30.3"`,
+				`"container": "ghcr.io/github/github-mcp-server:v0.31.0"`,
 				`"env": {`,
 			},
 			unexpectedContent: []string{},
diff --git a/pkg/workflow/docker_predownload_test.go b/pkg/workflow/docker_predownload_test.go
index 8024e45a41e..6fddd156900 100644
--- a/pkg/workflow/docker_predownload_test.go
+++ b/pkg/workflow/docker_predownload_test.go
@@ -34,7 +34,7 @@ tools:
 # Test
 Test workflow.`,
 			expectedImages: []string{
-				"ghcr.io/github/github-mcp-server:v0.30.3",
+				"ghcr.io/github/github-mcp-server:" + string(constants.DefaultGitHubMCPServerVersion),
 			},
 			expectStep: true,
 		},
@@ -70,7 +70,7 @@ mcp-servers:
 # Test
 Test workflow with custom MCP container.`,
 			expectedImages: []string{
-				"ghcr.io/github/github-mcp-server:v0.30.3",
+				"ghcr.io/github/github-mcp-server:" + string(constants.DefaultGitHubMCPServerVersion),
 				"ghcr.io/github/gh-aw-mcpg:" + string(constants.DefaultMCPGatewayVersion),
 				"myorg/custom-mcp:v1.0.0",
 			},
@@ -148,7 +148,7 @@ tools:
 Test workflow with both GitHub and Serena tools.`,
 			expectedImages: []string{
 				"ghcr.io/github/gh-aw-mcpg:" + string(constants.DefaultMCPGatewayVersion),
-				"ghcr.io/github/github-mcp-server:v0.30.3",
+				"ghcr.io/github/github-mcp-server:" + string(constants.DefaultGitHubMCPServerVersion),
 				constants.DefaultSerenaMCPServerContainer + ":latest",
 			},
 			expectStep: true,
diff --git a/pkg/workflow/github_remote_mode_test.go b/pkg/workflow/github_remote_mode_test.go
index caab67e09dd..74ffb1469ae 100644
--- a/pkg/workflow/github_remote_mode_test.go
+++ b/pkg/workflow/github_remote_mode_test.go
@@ -317,7 +317,7 @@ This is a test workflow for GitHub remote mode configuration.
 						t.Errorf("Expected container field but didn't find it in:\n%s", lockContent)
 					}
 				}
-				if !strings.Contains(lockContent, `ghcr.io/github/github-mcp-server:v0.30.3`) {
+				if !strings.Contains(lockContent, `ghcr.io/github/github-mcp-server:v0.31.0`) {
 					t.Errorf("Expected Docker image but didn't find it in:\n%s", lockContent)
 				}
 				// Should NOT contain HTTP type
diff --git a/pkg/workflow/mcp_config_test.go b/pkg/workflow/mcp_config_test.go
index bc8c3e5087f..05eaefa43a1 100644
--- a/pkg/workflow/mcp_config_test.go
+++ b/pkg/workflow/mcp_config_test.go
@@ -38,7 +38,7 @@ tools:
 			// With Docker MCP always enabled, default is docker (not services)
 			expectedType:        "docker",
 			expectedCommand:     "docker",
-			expectedDockerImage: "ghcr.io/github/github-mcp-server:v0.30.3",
+			expectedDockerImage: "ghcr.io/github/github-mcp-server:v0.31.0",
 		},
 	}
 
@@ -173,7 +173,7 @@ func TestGenerateGitHubMCPConfig(t *testing.T) {
 
 			switch tt.expectedType {
 			case "docker":
-				if !strings.Contains(result, `"container": "ghcr.io/github/github-mcp-server:v0.30.3"`) {
+				if !strings.Contains(result, `"container": "ghcr.io/github/github-mcp-server:v0.31.0"`) {
 					t.Errorf("Expected container field with GitHub MCP image but got:\n%s", result)
 				}
 				if strings.Contains(result, `"type": "http"`) {
diff --git a/pkg/workflow/test-yaml-import.lock.yml b/pkg/workflow/test-yaml-import.lock.yml
index 73df1ff1930..810f79e23a5 100644
--- a/pkg/workflow/test-yaml-import.lock.yml
+++ b/pkg/workflow/test-yaml-import.lock.yml
@@ -141,7 +141,7 @@ jobs:
             const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
             await determineAutomaticLockdown(github, context, core);
       - name: Download container images
-        run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent-act:0.13.4 ghcr.io/github/gh-aw-firewall/squid:0.13.4 ghcr.io/github/gh-aw-mcpg:v0.0.98 ghcr.io/github/github-mcp-server:v0.30.3
+        run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent-act:0.13.4 ghcr.io/github/gh-aw-firewall/squid:0.13.4 ghcr.io/github/gh-aw-mcpg:v0.0.98 ghcr.io/github/github-mcp-server:v0.31.0
       - name: Start MCP gateway
         id: start-mcp-gateway
         env:
@@ -170,7 +170,7 @@ jobs:
             "mcpServers": {
               "github": {
                 "type": "stdio",
-                "container": "ghcr.io/github/github-mcp-server:v0.30.3",
+                "container": "ghcr.io/github/github-mcp-server:v0.31.0",
                 "env": {
                   "GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
diff --git a/scratchpad/layout.md b/scratchpad/layout.md
index 235af6e39f1..91e11b5ec5e 100644
--- a/scratchpad/layout.md
+++ b/scratchpad/layout.md
@@ -197,7 +197,7 @@ const AgenticWorkflowsMCPServerID = "agenticworkflows"
 const DefaultCopilotVersion Version = "0.0.410"
 const DefaultClaudeCodeVersion Version = "2.1.42"
 const DefaultCodexVersion Version = "0.101.0"
-const DefaultGitHubMCPServerVersion Version = "v0.30.3"
+const DefaultGitHubMCPServerVersion Version = "v0.31.0"
 const DefaultFirewallVersion Version = "v0.18.0"
 const DefaultMCPGatewayVersion Version = "v0.1.4"
 const DefaultPlaywrightMCPVersion Version = "0.0.68"