diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index a386875f9d..8a3399b0a9 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -28,7 +28,7 @@ permissions: {}
 # post-review's footer all read these instead of hardcoding them separately.
 env:
   CLAUDE_MODEL: claude-opus-5
-  CODEX_MODEL: gpt-5.6-sol
+  CODEX_MODEL: gpt-6-sol
 
 # Non-command issue_comment events fire for every comment on every PR, so grouping by PR number
 # alone would let any comment cancel an in-flight review; give those runs their own per-run
@@ -307,7 +307,8 @@ jobs:
           effort: high
           output-schema-file: /tmp/ai-review/findings.schema.json
           output-file: /tmp/ai-review/codex-findings.json
-          codex-version: "0.150.1"
+          # 0.156.1 is the first stable CLI whose model catalog carries gpt-6-sol.
+          codex-version: &codex-cli-version "0.156.1"
           working-directory: ${{ github.workspace }}
           safety-strategy: drop-sudo
           sandbox: read-only
@@ -448,8 +449,8 @@ jobs:
       # `working-directory` is the workspace root so Codex's cwd holds no untrusted AGENTS.md/
       # config; it reads the PR from `pr/` and executes nothing from it.
       - name: Run Codex adjudication
-        # Same v1.11 pin as codex-review's step above (see its comment for the full rationale);
-        # YAML-aliased so the SHA only needs to change in one place.
+        # Same v1.11 action pin and Codex CLI version as codex-review's step above (see its
+        # comments for the rationale); both are YAML-aliased so each changes in one place only.
         uses: *codex-action-pin
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
@@ -458,7 +459,7 @@ jobs:
           effort: high
           output-schema-file: /tmp/ai-review/merged-review.schema.json
           output-file: /tmp/ai-review/merged-review.json
-          codex-version: "0.150.1"
+          codex-version: *codex-cli-version
           working-directory: ${{ github.workspace }}
           safety-strategy: drop-sudo
           sandbox: read-only