diff --git a/docs/src/content/docs/blog/2026-09-08-agent-of-the-day.md b/docs/src/content/docs/blog/2026-09-08-agent-of-the-day.md
new file mode 100644
index 00000000000..f42c58e828b
--- /dev/null
+++ b/docs/src/content/docs/blog/2026-09-08-agent-of-the-day.md
@@ -0,0 +1,30 @@
+---
+title: "Agent of the Day – September 8, 2026"
+description: "Meet CLI Version Checker, the agent that quietly keeps gh-aw's toolchain current."
+authors:
+  - copilot
+date: 2026-09-08
+metadata:
+  seoDescription: "CLI Version Checker: the gh-aw agent that tracks CLI/Docker versions and opens PRs only when something actually changed."
+  linkedPostText: "How CLI Version Checker keeps gh-aw's toolchain honest"
+---
+
+Every toolchain rots a little every day. Dependencies drift, CLIs ship silent patches, base images get new digests — and nobody notices until something breaks in CI at the worst possible moment. Today's Agent of the Day exists specifically to make sure that never happens quietly: the **CLI Version Checker**.
+
+## Agent of the Day: CLI Version Checker
+
+This workflow runs on a daily schedule and has one job: watch eight different tools — Claude Code, GitHub Copilot CLI, OpenAI Codex, GitHub MCP Server, Playwright CLI, MCP Gateway, Pi, and threat-detect — plus a stack of Docker images (actionlint, syft, grype, grant, zizmor, poutine, runner-guard, yamllint) for version or digest changes. When it finds one, it opens a pull request. When it doesn't, it says nothing and exits — no busywork issues, no noise.
+
+Looking at the last five scheduled runs, the pattern is exactly what you'd want from an agent like this:
+
+- [Run #552](https://github.com/github/gh-aw/actions/runs/34190826308) (Sep 8) — completed in 7.6 minutes, checked every tracked package via `npm view` and the GitHub Releases API, found nothing new to update, and exited cleanly.
+- [Run from Sep 7](https://github.com/github/gh-aw/actions/runs/34087039920) and [Sep 6](https://github.com/github/gh-aw/actions/runs/34013998383) — same story: full version sweep, no drift detected, quiet success.
+- Two earlier runs on Sep 4–5 failed outright, a useful reminder that even a narrowly-scoped, read-mostly agent needs monitoring too.
+
+What makes this workflow interesting isn't the happy path — it's the discipline baked into the process. The agent is instructed to check a local cache before doing any network calls, to prefer `npm view` over web-fetch for package metadata (cheaper and faster), and to fetch every tool's version in parallel rather than serially grinding through eight lookups one at a time. When it does detect a real change, it doesn't just bump a constant — it pulls GitHub release notes, converts every `#1234` PR reference into a full external URL, categorizes changes as Breaking/Features/Fixes/Security/Performance, and only then runs `make recompile` before opening the PR.
+
+The audit trail also surfaced something small but real: every recent run hit a firewalled domain, `ab.chatgpt.com:443`, and got blocked — 1 request out of roughly 50 per run. Harmless in this case (the agent's actual work sails through on `api.openai.com`), but it's exactly the kind of "friction" signal that `gh aw`'s built-in auditing is designed to surface so maintainers can decide whether to allow-list it or leave the firewall as-is.
+
+There's a quieter lesson here too: not every agent needs to be flashy to be valuable. CLI Version Checker doesn't triage issues or refactor code — it just refuses to let toolchain drift become tomorrow's fire drill. That's the kind of agent you forget exists, right up until the day it saves you from shipping against a version nobody remembered to check.
+
+Curious how a workflow like this is put together, or want to build your own quietly-vigilant agent? Check out [github/gh-aw](https://github.com/github/gh-aw).