diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 3ebbe8774ccf..d4ebf47ecc89 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -136,6 +136,7 @@ jobs:
     env:
       DISABLE_V8_COMPILE_CACHE: 1
       VERSION: 0.0.0
+      VSCODE_ARCH: x64
       VSCODE_TARGET: linux-x64
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       ELECTRON_SKIP_BINARY_DOWNLOAD: 1
@@ -159,13 +160,13 @@ jobs:
           cache-dependency-path: |
             package-lock.json
             test/package-lock.json
-      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-      - run: npm run build
+
       # Get Code's git hash.  When this changes it means the content is
       # different and we need to rebuild.
       - name: Get latest lib/vscode rev
         id: vscode-rev
         run: echo "rev=$(git rev-parse HEAD:./lib/vscode)" >> $GITHUB_OUTPUT
+
       # We need to rebuild when we have a new version of Code, when any of the
       # patches changed, or when the code-server version changes (since it gets
       # embedded into the code).  Use VSCODE_CACHE_VERSION to force a rebuild.
@@ -178,10 +179,21 @@ jobs:
       - name: Build vscode
         if: steps.cache-vscode.outputs.cache-hit != 'true'
         run: |
-          pushd lib/vscode
+          cd lib/vscode/build
+          npm ci
+          cd ..
+          source ./build/azure-pipelines/linux/setup-env.sh
+          # Run preinstall script before root dependencies are installed
+          # so that v8 headers are patched correctly for native modules.
+          node build/npm/preinstall.ts
           npm ci
-          popd
+          cd ../..
           npm run build:vscode
+
+      # Build the code-server wrapper.
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+      - run: npm run build
+
       # Push up an artifact containing the linux-x64 release.
       - run: KEEP_MODULES=1 npm run release
       - run: tar -czf package.tar.gz release
diff --git a/.node-version b/.node-version
index 8dfc5cb1af4f..b7179aed06e8 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-24.18.1
+24.20.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a067d5c9bd1..651a69c52e92 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,10 +22,19 @@ Code v99.99.999
 
 ## Unreleased
 
+## [4.139.1](https://github.com/coder/code-server/releases/tag/v4.139.1) - 2026-09-26
+
+Code v1.139.1
+
+### Changed
+
+- Update to Code 1.139.1
+
 ### Fixed
 
-- `--idle-timeout-seconds` was only validated when passed as `--idle-timeout-seconds=<value>`;
-  values of 60 or less passed as `--idle-timeout-seconds <value>` were silently accepted.
+- `--idle-timeout-seconds` was only validated when passed as
+  `--idle-timeout-seconds=<value>`; values of 60 or less passed as
+  `--idle-timeout-seconds <value>` were silently accepted.
 
 ## [4.138.0](https://github.com/coder/code-server/releases/tag/v4.138.0) - 2026-09-19
 
diff --git a/ci/helm-chart/Chart.yaml b/ci/helm-chart/Chart.yaml
index e5f23272931f..92a83efe9d05 100644
--- a/ci/helm-chart/Chart.yaml
+++ b/ci/helm-chart/Chart.yaml
@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.53.0
+version: 3.54.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.138.0
+appVersion: 4.139.1
diff --git a/ci/helm-chart/values.yaml b/ci/helm-chart/values.yaml
index 8a6bca53ca72..b7657868b1ea 100644
--- a/ci/helm-chart/values.yaml
+++ b/ci/helm-chart/values.yaml
@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: ghcr.io/motuslabs/code-server
-  tag: '4.138.0'
+  tag: '4.139.1'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a
diff --git a/docs/guide.md b/docs/guide.md
index 0aa8901c36a1..c661caae60ea 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -9,6 +9,7 @@
   - [Using Let's Encrypt with NGINX](#using-lets-encrypt-with-nginx)
   - [Using a self-signed certificate](#using-a-self-signed-certificate)
   - [TLS 1.3 and Safari](#tls-13-and-safari)
+  - [Cloudflare Rocket Loader](#cloudflare-rocket-loader)
 - [External authentication](#external-authentication)
 - [HTTPS and self-signed certificates](#https-and-self-signed-certificates)
 - [Accessing web services](#accessing-web-services)
@@ -269,6 +270,26 @@ than TLS 1.3 you will need to add support for TLS 1.2 since Safari does not
 support TLS 1.3 for web sockets at the time of writing. If this is the case you
 should see OSSStatus: 9836 in the browser console.
 
+### Cloudflare Rocket Loader
+
+If you serve code-server through Cloudflare, disable Rocket Loader for that
+hostname. Rocket Loader rewrites inline `<script>` tags at the edge and
+re-injects them from its own loader, and the re-injected scripts do not carry
+the nonce in code-server's Content Security Policy, so the browser blocks them.
+The result is a blank page: every request returns HTTP 200 and the server logs
+look healthy, and the only console output is `Cannot determine URI for module
+id!`.
+
+Scope it with a Configuration Rule rather than turning it off zone-wide:
+
+```
+Expression: (http.host eq "code.example.com")
+Setting:    Rocket Loader -> Off
+```
+
+Adding `'unsafe-inline'` to the policy does not help, because CSP ignores it
+whenever a nonce or hash is present.
+
 ## External authentication
 
 If you want to use external authentication mechanism (e.g., Sign in with
diff --git a/docs/helm.md b/docs/helm.md
index 78ab30af24af..6f0799f4f6ba 100644
--- a/docs/helm.md
+++ b/docs/helm.md
@@ -1,6 +1,6 @@
 # code-server Helm Chart
 
-[![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square)](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) [![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![AppVersion: 4.8.0](https://img.shields.io/badge/AppVersion-4.8.0-informational?style=flat-square)](https://img.shields.io/badge/AppVersion-4.8.0-informational?style=flat-square)
+[![Version: 3.54.0](https://img.shields.io/badge/Version-3.54.0-informational?style=flat-square)](https://img.shields.io/badge/Version-3.54.0-informational?style=flat-square) [![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![AppVersion: 4.139.1](https://img.shields.io/badge/AppVersion-4.139.1-informational?style=flat-square)](https://img.shields.io/badge/AppVersion-4.139.1-informational?style=flat-square)
 
 [code-server](https://github.com/coder/code-server) code-server is VS Code running
 on a remote server, accessible through the browser.
@@ -62,10 +62,12 @@ and their default values.
 | Key                                         | Type   | Default                           |
 | ------------------------------------------- | ------ | --------------------------------- |
 | affinity                                    | object | `{}`                              |
+| annotations                                 | object | `{}`                              |
 | extraArgs                                   | list   | `[]`                              |
 | extraConfigmapMounts                        | list   | `[]`                              |
 | extraContainers                             | string | `""`                              |
 | extraInitContainers                         | string | `""`                              |
+| extraPorts                                  | list   | `[]`                              |
 | extraSecretMounts                           | list   | `[]`                              |
 | extraVars                                   | list   | `[]`                              |
 | extraVolumeMounts                           | list   | `[]`                              |
@@ -73,26 +75,32 @@ and their default values.
 | hostnameOverride                            | string | `""`                              |
 | image.pullPolicy                            | string | `"Always"`                        |
 | image.repository                            | string | `"ghcr.io/motuslabs/code-server"` |
-| image.tag                                   | string | `"4.8.0"`                         |
+| image.tag                                   | string | `"4.139.1"`                       |
 | imagePullSecrets                            | list   | `[]`                              |
 | ingress.enabled                             | bool   | `false`                           |
+| ingress.ingressClassName                    | string | `""`                              |
+| lifecycle.enabled                           | bool   | `false`                           |
+| livenessProbe.enabled                       | bool   | `true`                            |
 | nameOverride                                | string | `""`                              |
 | nodeSelector                                | object | `{}`                              |
 | persistence.accessMode                      | string | `"ReadWriteOnce"`                 |
 | persistence.annotations                     | object | `{}`                              |
 | persistence.enabled                         | bool   | `true`                            |
-| persistence.size                            | string | `"1Gi"`                           |
+| persistence.size                            | string | `"10Gi"`                          |
 | podAnnotations                              | object | `{}`                              |
 | podSecurityContext                          | object | `{}`                              |
+| priorityClassName                           | string | `""`                              |
+| readinessProbe.enabled                      | bool   | `true`                            |
 | replicaCount                                | int    | `1`                               |
 | resources                                   | object | `{}`                              |
 | securityContext.enabled                     | bool   | `true`                            |
 | securityContext.fsGroup                     | int    | `1000`                            |
 | securityContext.runAsUser                   | int    | `1000`                            |
-| service.port                                | int    | `8443`                            |
+| service.port                                | int    | `8080`                            |
 | service.type                                | string | `"ClusterIP"`                     |
+| serviceAccount.annotations                  | object | `{}`                              |
 | serviceAccount.create                       | bool   | `true`                            |
-| serviceAccount.name                         | string | `nil`                             |
+| serviceAccount.name                         | string | `""`                              |
 | tolerations                                 | list   | `[]`                              |
 | volumePermissions.enabled                   | bool   | `true`                            |
 | volumePermissions.securityContext.runAsUser | int    | `0`                               |
@@ -114,7 +122,7 @@ can be provided while installing the chart. For example,
 $ helm upgrade --install code-server ci/helm-chart -f values.yaml
 ```
 
-> **Tip**: You can use the default [values.yaml](values.yaml)
+> **Tip**: You can use the default [values.yaml](../ci/helm-chart/values.yaml)
 
 # Extra Containers
 
diff --git a/lib/vscode b/lib/vscode
index 7debcd0e2acd..04c0d99f4fb0 160000
--- a/lib/vscode
+++ b/lib/vscode
@@ -1 +1 @@
-Subproject commit 7debcd0e2acdea1c52de81bf9ee1620444407dda
+Subproject commit 04c0d99f4fb0d8afe6ce4f0c58e31e183ac3e4b1
diff --git a/package-lock.json b/package-lock.json
index fe1af8d118f3..f853657d3101 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3697,9 +3697,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -5243,9 +5243,9 @@
       }
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -5253,6 +5253,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/proxy-agent": {
diff --git a/patches/copilot.diff b/patches/copilot.diff
index c66ccdb09cbe..22075a19a478 100644
--- a/patches/copilot.diff
+++ b/patches/copilot.diff
@@ -44,7 +44,7 @@ Index: code-server/lib/vscode/build/lib/extensions.ts
  import watcher from './watch/index.ts';
  
  import { createRequire } from 'module';
-@@ -491,6 +492,116 @@ export function packageCopilotExtensionS
+@@ -487,6 +488,116 @@ export function packageCopilotExtensionS
  	).pipe(util2.setExecutableBit(['**/*.sh']));
  }
  
diff --git a/patches/display-language.diff b/patches/display-language.diff
index ee643972dcee..361bf2f78b05 100644
--- a/patches/display-language.diff
+++ b/patches/display-language.diff
@@ -56,7 +56,7 @@ Index: code-server/lib/vscode/src/vs/server/node/remoteLanguagePacks.ts
  import type { INLSConfiguration } from '../../nls.js';
 @@ -33,7 +35,94 @@ export async function getNLSConfiguratio
  	if (!result) {
- 		result = resolveNLSConfiguration({ userLocale: language, osLocale: language, commit: product.commit, userDataPath, nlsMetadataPath });
+ 		result = resolveNLSConfiguration({ userLocale: language, osLocale: language, commit: product.commit, nlsMetadataHash: product.nlsMetadataHash, userDataPath, nlsMetadataPath });
  		nlsConfigurationCache.set(cacheKey, result);
 +		// If the language pack does not yet exist, it defaults to English, which is
 +		// then cached and you have to restart even if you then install the pack.
diff --git a/patches/getting-started.diff b/patches/getting-started.diff
index a8ba914dfb37..dab9d4144957 100644
--- a/patches/getting-started.diff
+++ b/patches/getting-started.diff
@@ -19,7 +19,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { renderFormattedText } from '../../../../base/browser/formattedTextRenderer.js';
  import { status } from '../../../../base/browser/ui/aria/aria.js';
  import { StandardKeyboardEvent } from '../../../../base/browser/keyboardEvent.js';
-@@ -54,7 +54,7 @@ import { IRecentFolder, IRecentWorkspace
+@@ -55,7 +55,7 @@ import { IRecentFolder, IRecentWorkspace
  import { OpenRecentAction } from '../../../browser/actions/windowActions.js';
  import { OpenFileFolderAction, OpenFolderAction, OpenFolderViaWorkspaceAction } from '../../../browser/actions/workspaceActions.js';
  import { EditorPane } from '../../../browser/parts/editor/editorPane.js';
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { IEditorOpenContext, IEditorSerializer } from '../../../common/editor.js';
  import { IWebviewElement, IWebviewService } from '../../webview/browser/webview.js';
  import './gettingStartedColors.js';
-@@ -928,6 +928,72 @@ export class GettingStartedPage extends
+@@ -930,6 +930,72 @@ export class GettingStartedPage extends
  			$('p.subtitle.description', {}, localize({ key: 'gettingStarted.editingEvolved', comment: ['Shown as subtitle on the Welcome page.'] }, "Editing evolved"))
  		);
  
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  		const leftColumn = $('.categories-column.categories-column-left', {},);
  		const rightColumn = $('.categories-column.categories-column-right', {},);
  
-@@ -977,6 +1043,9 @@ export class GettingStartedPage extends
+@@ -980,6 +1046,9 @@ export class GettingStartedPage extends
  				recentList.setLimit(5);
  				reset(leftColumn, startList.getDomElement(), recentList.getDomElement());
  			}
diff --git a/patches/local-storage.diff b/patches/local-storage.diff
index c42dd189f062..7799e532ed90 100644
--- a/patches/local-storage.diff
+++ b/patches/local-storage.diff
@@ -66,7 +66,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
-@@ -148,8 +148,10 @@ export class WorkspaceService extends Di
+@@ -150,8 +150,10 @@ export class WorkspaceService extends Di
  		this.workspaceConfiguration = this._register(new WorkspaceConfiguration(configurationCache, fileService, uriIdentityService, logService));
  		this._register(this.workspaceConfiguration.onDidUpdateConfiguration(fromCache => {
  			this.onWorkspaceConfigurationChanged(fromCache).then(() => {
@@ -79,7 +79,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
  			});
  		}));
  
-@@ -561,6 +563,12 @@ export class WorkspaceService extends Di
+@@ -563,6 +565,12 @@ export class WorkspaceService extends Di
  			previousFolders = this.workspace.folders;
  			this.workspace.update(workspace);
  		} else {
diff --git a/patches/marketplace.diff b/patches/marketplace.diff
index efd76c2c01c4..5e867ee61a51 100644
--- a/patches/marketplace.diff
+++ b/patches/marketplace.diff
@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
 @@ -65,6 +65,17 @@ else if (globalThis._VSCODE_PRODUCT_JSON
- 			Object.assign(product, { copilotVersions: { runtime, sdk } });
+ 			Object.assign(product, { copilotVersions: { runtime: packageConfiguration.copilotRuntimeVersion, sdk } });
  		}
  	}
 +
diff --git a/patches/osc52-clipboard.diff b/patches/osc52-clipboard.diff
index 5bce3a2cddd4..21dfcca8dcce 100644
--- a/patches/osc52-clipboard.diff
+++ b/patches/osc52-clipboard.diff
@@ -29,7 +29,7 @@ Index: code-server/lib/vscode/src/vs/platform/clipboard/browser/clipboardService
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/clipboard/browser/clipboardService.ts
 +++ code-server/lib/vscode/src/vs/platform/clipboard/browser/clipboardService.ts
-@@ -124,8 +124,9 @@ export class BrowserClipboardService ext
+@@ -132,8 +132,9 @@ export class BrowserClipboardService ext
  		// Clear resources given we are writing text
  		this.clearResourcesState();
  
diff --git a/patches/sourcemaps.diff b/patches/sourcemaps.diff
index 22ca7ef04323..fdf69d39a37d 100644
--- a/patches/sourcemaps.diff
+++ b/patches/sourcemaps.diff
@@ -6,7 +6,7 @@ Index: code-server/lib/vscode/build/gulpfile.reh.ts
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.reh.ts
 +++ code-server/lib/vscode/build/gulpfile.reh.ts
-@@ -344,10 +344,15 @@ function packageTask(type: string, platf
+@@ -260,10 +260,15 @@ function packageTask(type: string, platf
  	const destination = path.join(BUILD_ROOT, destinationFolderName);
  
  	return () => {
diff --git a/patches/update-check.diff b/patches/update-check.diff
index 682faf18b613..091f787e81c3 100644
--- a/patches/update-check.diff
+++ b/patches/update-check.diff
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
  
  	readonly version: string;
  	readonly date?: string;
-@@ -145,6 +146,7 @@ export interface IProductConfiguration {
+@@ -148,6 +149,7 @@ export interface IProductConfiguration {
  	};
  
  	readonly extensionsGallery?: {
diff --git a/test/e2e/extensions.test.ts b/test/e2e/extensions.test.ts
index 70869c03c062..376bdce3ab5d 100644
--- a/test/e2e/extensions.test.ts
+++ b/test/e2e/extensions.test.ts
@@ -54,9 +54,9 @@ function runExternalUriTests(proxyEndpointTemplate?: string) {
       await codeServerPage.waitForTestExtensionLoaded()
       await codeServerPage.executeCommandViaMenus("code-server: asExternalUri test")
 
-      const inputBox = codeServerPage.page.locator(".quick-input-widget input")
-      await inputBox.fill(input)
-      await inputBox.press("Enter")
+      await codeServerPage.page.waitForSelector(".quick-input-widget:focus-within")
+      await codeServerPage.page.keyboard.type(input)
+      await codeServerPage.page.keyboard.press("Enter")
 
       // The test extension displays URI.toString(), which also encodes query delimiters.
       const output = `${proxyBase.replace(/\/$/, "")}${suffix}`
diff --git a/test/e2e/models/CodeServer.ts b/test/e2e/models/CodeServer.ts
index 4017445db752..7423ac9f629a 100644
--- a/test/e2e/models/CodeServer.ts
+++ b/test/e2e/models/CodeServer.ts
@@ -437,6 +437,7 @@ export class CodeServerPage {
   async executeCommandViaMenus(command: string) {
     await this.navigateMenus(["View", "Command Palette..."])
 
+    await this.page.waitForSelector(".quick-input-widget:focus-within")
     await this.page.keyboard.type(command)
 
     await this.page.hover(`text=${command}`)