diff --git a/startos/main.ts b/startos/main.ts
index d7827c7..7461aa6 100644
--- a/startos/main.ts
+++ b/startos/main.ts
@@ -256,7 +256,9 @@ export const main = sdk.setupMain(async ({ effects }) => {
     'export PATH=/root/.cargo/bin:/data/bin:/usr/local/bin:/usr/bin:/bin',
     "export PS1='spaces:\\w$ '",
     `alias spaces='space-cli --chain ${SPACED_CHAIN} --rpc-user "$SPACED_RPC_USER" --rpc-password "$SPACED_RPC_PASSWORD" '`,
-    'cat <<EOF',
+    // Quoted delimiter: banner copy uses backticks around CLI names; an unquoted
+    // <<EOF would run command substitution (including `monitor` on PATH).
+    'cat <<\'EOF\'',
     '',
     // Banner rendered via renderBanner() — auto-wraps any line that exceeds the
     // 96-cell text budget and pads every emitted line to exactly 100 cells, so
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index c0ec7e7..27d895c 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -1,11 +1,13 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '0.2.1:1',
+  version: '0.2.1:3',
   releaseNotes: {
-    en_US: `Packaging-only revision — no upstream changes. The images are unchanged from 0.2.1:0 (\`spaces:v0.2.1\`, \`subs:v0.1.2\`, \`certrelay:v0.2.5\`, \`nacho:v1.0.0\`).
+    en_US: `Packaging-only revision — no upstream image changes (\`spaces:v0.2.1\`, \`subs:v0.1.2\`, \`certrelay:v0.2.5\`, \`nacho:v1.0.0\`).
 
-Rebuilt against \`start-sdk\` 2.0.9, which requires StartOS 0.4.0-beta.10.`,
+**Fix:** the Space-CLI web terminal no longer runs \`monitor\` on every login. The MOTD heredoc in \`.bashrc\` now uses a quoted delimiter so backticks in the banner (e.g. around \`monitor\`) are printed literally instead of executing command substitution.
+
+Requires StartOS 0.4.0-beta.10 (\`start-sdk\` 2.0.9).`,
   },
   migrations: {
     up: async ({ effects }) => {},