diff --git a/HARNESS_WIKI.md b/HARNESS_WIKI.md
index 14d2ec2..f2c79cb 100644
--- a/HARNESS_WIKI.md
+++ b/HARNESS_WIKI.md
@@ -147,7 +147,7 @@ End-to-end trace of `strix --target ./app`:
 1. **CLI parse** (`interface/main.py:267-426`): parse args, validate, infer target types via `infer_target_type()` (`interface/utils.py`). Resolve diff scope if `--scope-mode=diff`.
 2. **Config layering** (`config/config.py`): apply `~/.strix/cli-config.json` (or `--config <path>` override) into `os.environ`; resolve `STRIX_LLM`, `LLM_API_KEY` via `resolve_llm_config()` at `config/config.py:199-224`.
 3. **LLM warm**: validate model reachable.
-4. **Docker pull** if needed; image pin `ghcr.io/usestrix/strix-sandbox:0.1.13` (`config/config.py:43`).
+4. **Docker pull** if needed; image pin `ghcr.io/usestrix/strix-sandbox:0.2.0` (`strix/config/settings.py:64`).
 5. **Run name + run dir**: `strix_runs/<run-name>/`. Tracer init (`telemetry/tracer.py:50+`).
 6. **Mode dispatch**: TUI (`tui.py`) or CLI (`cli.py`). Both end up calling `StrixAgent.execute_scan(scan_config)`.
 7. **Sandbox launch** (`runtime/docker_runtime.py:111-173`): container created with name `strix-scan-{scan_id}`, two random host ports mapped to container ports `48080` (Caido) and `48081` (tool server), 32-byte bearer token generated, `local_sources` tar-copied into `/workspace`.
@@ -442,7 +442,7 @@ Three layers of defense before tool output reaches the model or telemetry:
 - Self-signed CA chain at `/app/certs/{ca.key,ca.crt,ca.p12}`, 3650-day validity (lines 52-71).
 - Workspace `/workspace` owned by pentester (line 194).
 - Ports `48080` (Caido), `48081` (tool server) exposed.
-- Image pin: `ghcr.io/usestrix/strix-sandbox:0.1.13` (`strix/config/config.py:43`, bumped in `640bd67`).
+- Image pin: `ghcr.io/usestrix/strix-sandbox:0.2.0` (`strix/config/settings.py:64`).
 
 ### 8.2 Boot Sequence (`containers/docker-entrypoint.sh`)
 
@@ -637,7 +637,7 @@ There **is no separate persona file**. All agents are `StrixAgent` instances usi
 | `llm_timeout` | `"300"` | Outer LLM timeout. |
 | `perplexity_api_key` | `None` | Web search. |
 | `strix_disable_browser` | `"false"` | Skip browser tool registration. |
-| `strix_image` | `"ghcr.io/usestrix/strix-sandbox:0.1.13"` | Sandbox image pin. |
+| `strix_image` | `"ghcr.io/usestrix/strix-sandbox:0.2.0"` | Sandbox image pin. |
 | `strix_runtime_backend` | `"docker"` | Only `docker` supported. |
 | `strix_sandbox_execution_timeout` | `"120"` | Tool exec timeout (s). |
 | `strix_sandbox_connect_timeout` | `"10"` | Tool server connect timeout. |
diff --git a/MIGRATION_EVALUATION.md b/MIGRATION_EVALUATION.md
index 7cfa82b..fbbc5ef 100644
--- a/MIGRATION_EVALUATION.md
+++ b/MIGRATION_EVALUATION.md
@@ -132,7 +132,7 @@ All 13 Strix tools port. Multi-agent-graph tools are now in §4.
 
 | Strix capability | SDK equivalent | Match |
 |---|---|---|
-| Custom Kali image | `DockerSandboxClientOptions(image="ghcr.io/.../strix-sandbox:0.1.13")` | 1:1 |
+| Custom Kali image | `DockerSandboxClientOptions(image="ghcr.io/.../strix-sandbox:0.2.0")` | 1:1 |
 | `cap_add=NET_ADMIN,NET_RAW` + `extra_hosts=host.docker.internal` | **Subclass `DockerSandboxClient`, inject into `containers.create()` kwargs** | Bridgeable | ~80 LOC |
 | Caido HTTPS proxy + CA cert + system-wide proxy env | Image-baked (Dockerfile + entrypoint stay as-is); `Manifest.environment` for runtime overrides; custom `CaidoCapability` for the 7 Caido tools + system-prompt instruction block | Bridgeable | ~200 LOC capability |
 | FastAPI tool server + Bearer auth | **Stays in the image.** Function tools wrap HTTP calls to it. Network isolation + Bearer auth preserved at transport layer. SDK's "in-process tools" model becomes "function tool that POSTs to localhost:48081 inside our shared session." | 1:1 in effect |
diff --git a/strix/config/settings.py b/strix/config/settings.py
index 6f59010..1cfffc4 100644
--- a/strix/config/settings.py
+++ b/strix/config/settings.py
@@ -61,7 +61,7 @@ class RuntimeSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
     image: str = Field(
-        default="ghcr.io/usestrix/strix-sandbox:0.1.13",
+        default="ghcr.io/usestrix/strix-sandbox:0.2.0",
         alias="STRIX_IMAGE",
     )
     backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND")
diff --git a/strix/orchestration/scan.py b/strix/orchestration/scan.py
index 4a85844..aceaf1a 100644
--- a/strix/orchestration/scan.py
+++ b/strix/orchestration/scan.py
@@ -191,7 +191,7 @@ async def run_strix_scan(
             if omitted — callers that want resume-after-crash semantics
             should pass a stable id.
         image: Docker image tag for the sandbox (e.g.
-            ``"strix-sandbox:0.1.13"``).
+            ``"strix-sandbox:0.2.0"``).
         sources_path: Host directory mounted into ``/workspace/sources``.
         tracer: Optional Strix tracer. Stored in context for the
             telemetry hook chain. Pass ``None`` for unit tests.
diff --git a/strix/runtime/session_manager.py b/strix/runtime/session_manager.py
index 99148f4..3859884 100644
--- a/strix/runtime/session_manager.py
+++ b/strix/runtime/session_manager.py
@@ -54,7 +54,7 @@ async def create_or_reuse(
 
     Args:
         scan_id: Caller-provided scan identifier (used as cache key).
-        image: Docker image tag (e.g. ``"strix-sandbox:0.1.13"``).
+        image: Docker image tag (e.g. ``"strix-sandbox:0.2.0"``).
         sources_path: Host directory mounted into the container's
             ``/workspace/sources`` so the agent can read user code.