diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8b9e72db645a..af670e891e49 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,11 +22,11 @@ Code v99.99.999
 
 ## Unreleased
 
-Code v1.129.1
+Code v1.130.0
 
 ### Changed
 
-- Update to Code 1.129.1
+- Update to Code 1.130.0
 
 ## [4.129.0](https://github.com/coder/code-server/releases/tag/v4.129.0) - 2026-07-17
 
diff --git a/lib/vscode b/lib/vscode
index 8a7abeba6e03..1b6a188127ee 160000
--- a/lib/vscode
+++ b/lib/vscode
@@ -1 +1 @@
-Subproject commit 8a7abeba6e03ea3af87bfbce9a1b7e48fed567b8
+Subproject commit 1b6a188127eeaf9194f945eb6eb89a657e93c54c
diff --git a/patches/csp-hashes.diff b/patches/csp-hashes.diff
index 0202248875e8..422ca3b61e6e 100644
--- a/patches/csp-hashes.diff
+++ b/patches/csp-hashes.diff
@@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  	<meta charset="UTF-8">
  
  	<meta http-equiv="Content-Security-Policy"
--		content="default-src 'none'; script-src 'sha256-nXjtuhBilO++r8hfxl5VjEScSmdm07wDAk6jw228DgM=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-A6/szVNdTzyi4hDa+9OLbzS8tSd2iUV4CqimLNWex2Y=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-FFQoOVVa2tOE3uqUvirwaMNT20TZmrHcL2aaOjJ8BUo=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
++		content="default-src 'none'; script-src 'sha256-24QqbpzqcqSyIGvg/ZwFRy5pPlhmVBa8CkUREEIUnBw=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
  
  	<!-- Disable pinch zooming -->
  	<meta name="viewport"
diff --git a/patches/webview.diff b/patches/webview.diff
index e3d82c35839c..b7d5893302cc 100644
--- a/patches/webview.diff
+++ b/patches/webview.diff
@@ -56,7 +56,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 @@ -253,7 +253,7 @@
  			}
  
- 			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}`);
+ 			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}&platform=${searchParams.get('platform')}`);
 -			navigator.serviceWorker.register(swPath, { type: 'module', updateViaCache: 'none' })
 +			navigator.serviceWorker.register(swPath)
  				.then(async registration => {