diff --git a/README.md b/README.md
index eaac509..0849ddb 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ through a browser-based terminal.
 | --- | --- |
 | Spaces image | `docker.io/horologger/spaces` |
 | Subspaces image | `docker.io/horologger/subs:v0.1.2` |
-| Certrelay image | `docker.io/horologger/certrelay:v0.2.3` |
+| Certrelay image | `docker.io/horologger/certrelay:v0.2.5` |
 | Nacho image | `docker.io/horologger/nacho:v1.0.0` |
 | Architectures | `linux/amd64`, `linux/arm64` |
 | Entrypoint | StartOS-managed (image entrypoints are **not** used directly) |
@@ -209,7 +209,7 @@ the same idempotent init logic runs and reuses the existing credentials in
    create it — create it first from the Space-CLI Web UI with `spaces
    createwallet` if you haven't.
 8. **Certrelay is always on.** It ships as the prebuilt
-    `horologger/certrelay:v0.2.3` image (static musl binaries) and runs on
+    `horologger/certrelay:v0.2.5` image (static musl binaries) and runs on
     7778 from service start. It talks to the local spaced over loopback using
     the `store.spacedAuth` credentials. The `fabric` and `monitor` binaries are copied to
     `/data/bin/` for manual use from the Space-CLI Web UI; neither is auto-started
@@ -250,9 +250,9 @@ spaces balance
 package_id: spaces
 upstream_version: subspacesplus
 images:
-  spaces: docker.io/horologger/spaces:v0.0.9s(x)
+  spaces: docker.io/horologger/spaces:v0.2.1
   subspaces: docker.io/horologger/subs:v0.1.2
-  certrelay: docker.io/horologger/certrelay:v0.2.3
+  certrelay: docker.io/horologger/certrelay:v0.2.5
   nacho: docker.io/horologger/nacho:v1.0.0
 architectures: [x86_64, aarch64]
 volumes:
@@ -329,7 +329,7 @@ subspaces:
       - set-subs-prover-credentials
 certrelay:
   always_on: true
-  image: horologger/certrelay:v0.2.3   # prebuilt; static musl binaries
+  image: horologger/certrelay:v0.2.5   # prebuilt; static musl binaries
   server_bin: /usr/local/bin/certrelay
   fabric_bin: /usr/local/bin/fabric    # copied to /data/bin/fabric for the CLI
   monitor_bin: /usr/local/bin/monitor  # copied to /data/bin/monitor (CLI only; not started)
diff --git a/startos/manifest/index.ts b/startos/manifest/index.ts
index dc874a1..69146f9 100644
--- a/startos/manifest/index.ts
+++ b/startos/manifest/index.ts
@@ -14,7 +14,7 @@ export const manifest = setupManifest({
   volumes: ['main'],
   images: {
     spaces: {
-      source: { dockerTag: 'horologger/spaces:v0.0.9x' },
+      source: { dockerTag: 'horologger/spaces:v0.2.1' },
       arch: ['x86_64', 'aarch64'],
     },
     subspaces: {
@@ -22,7 +22,7 @@ export const manifest = setupManifest({
       arch: ['x86_64', 'aarch64'],
     },
     certrelay: {
-      source: { dockerTag: 'horologger/certrelay:v0.2.3' },
+      source: { dockerTag: 'horologger/certrelay:v0.2.5' },
       arch: ['x86_64', 'aarch64'],
     },
     nacho: {
diff --git a/startos/versions/index.ts b/startos/versions/index.ts
index 1d5e240..14a9244 100644
--- a/startos/versions/index.ts
+++ b/startos/versions/index.ts
@@ -1,7 +1,7 @@
 import { VersionGraph } from '@start9labs/start-sdk'
-import { v_0_1_2_0 } from './v0.1.2.0'
+import { v_0_2_1_0 } from './v0.2.1.0'
 
 export const versionGraph = VersionGraph.of({
-  current: v_0_1_2_0,
+  current: v_0_2_1_0,
   other: [],
 })
diff --git a/startos/versions/v0.1.2.0.ts b/startos/versions/v0.1.2.0.ts
deleted file mode 100644
index 86fdea6..0000000
--- a/startos/versions/v0.1.2.0.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
-
-export const v_0_1_2_0 = VersionInfo.of({
-  version: '0.1.2:0',
-  releaseNotes: {
-    en_US: `- **Configure Subspaces** action toggles \`SUBS_PUBLISH_REQUIRE_FINALIZED\` on the \`subs\` daemon (default off). When enabled, subs blocks certificate publish until commitments are finalized (150 confirmations). Stored as \`store.subsPublishRequireFinalized\`; always injected into subs's environment as \`true\` or \`false\`.
-- **monitor CLI** from the certrelay image is now copied to \`/data/bin/monitor\` alongside \`fabric\` on each start (file only — not run as a daemon). Both are on PATH in the Space-CLI Web UI terminal.
-- **spaced image** updated to \`horologger/spaces:v0.0.9x\`.`,
-  },
-  migrations: {
-    up: async ({ effects }) => {},
-    down: IMPOSSIBLE,
-  },
-})
diff --git a/startos/versions/v0.2.1.0.ts b/startos/versions/v0.2.1.0.ts
new file mode 100644
index 0000000..a364fc6
--- /dev/null
+++ b/startos/versions/v0.2.1.0.ts
@@ -0,0 +1,13 @@
+import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_1_0 = VersionInfo.of({
+  version: '0.2.1:0',
+  releaseNotes: {
+    en_US: `- **spaced image** updated to \`horologger/spaces:v0.2.1\` (from v0.0.9x).
+- **Certrelay image** updated to \`horologger/certrelay:v0.2.5\` (from v0.2.3).`,
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: IMPOSSIBLE,
+  },
+})