diff --git a/README.md b/README.md
index 36b75d3..9b80047 100644
--- a/README.md
+++ b/README.md
@@ -37,8 +37,8 @@ through a browser-based terminal.
 
 | Field | Value |
 | --- | --- |
-| Spaces image | `docker.io/horologger/spaces:v0.3.0` |
-| Subspaces image | `docker.io/horologger/subs:v0.1.2c` |
+| Spaces image | `docker.io/horologger/spaces:v0.3.1` |
+| Subspaces image | `docker.io/horologger/subs:v0.1.2d` |
 | Certrelay image | `docker.io/horologger/certrelay:v0.2.8` |
 | Nacho image | `docker.io/horologger/nacho:v1.0.0b` |
 | Architectures | `linux/amd64`, `linux/arm64` |
@@ -201,7 +201,7 @@ the same idempotent init logic runs and reuses the existing credentials in
 6. **The web terminal is independent of spaced.** Gotty stays reachable even
    when `spaced` is crash-looping, so you can always shell in to diagnose.
 7. **Subspaces is opt-in.** Fresh installs do not run Subspaces. Run **Enable
-   Subspaces** to start it. It ships as the prebuilt `horologger/subs:v0.1.2c`
+   Subspaces** to start it. It ships as the prebuilt `horologger/subs:v0.1.2d`
    image (no compile step), so enabling is fast — the daemons start as soon
    as the image is on the box. Enabling runs three daemons, each with its own
    StartOS interface: **subs** (Web UI + Subs API, 7777), **registry-server**
@@ -257,8 +257,8 @@ spaces balance
 package_id: spaces
 upstream_version: subspacesplus
 images:
-  spaces: docker.io/horologger/spaces:v0.3.0
-  subspaces: docker.io/horologger/subs:v0.1.2c
+  spaces: docker.io/horologger/spaces:v0.3.1
+  subspaces: docker.io/horologger/subs:v0.1.2d
   certrelay: docker.io/horologger/certrelay:v0.2.8
   nacho: docker.io/horologger/nacho:v1.0.0b
 architectures: [x86_64, aarch64]
@@ -293,12 +293,12 @@ spaced_env_vars:
   - APP_USER
   - APP_PASSWORD
 spaces:
-  image: horologger/spaces:v0.3.0   # spaced, space-cli, gotty (terminal image)
+  image: horologger/spaces:v0.3.1   # spaced, space-cli, gotty (terminal image)
 subspaces:
   default_enabled: false   # opt-in via Enable Subspaces action
   store_field: enableSubspaces
   subs_prover_default_enabled: false   # separate toggle: set-subs-prover (store.enableSubsProver)
-  image: horologger/subs:v0.1.2c   # prebuilt; no compile step
+  image: horologger/subs:v0.1.2d   # prebuilt; no compile step
   data_dir: /data/subspaces/data
   wallet: default          # loaded by subs, NOT created (create via space-cli first)
   daemons:                 # three separate daemons, each its own interface
diff --git a/instructions.md b/instructions.md
index f718d80..53cfc95 100644
--- a/instructions.md
+++ b/instructions.md
@@ -80,8 +80,8 @@ Use **Show Registry API Keys** to retrieve the stored values later, or re-run
 
 - **Mainnet only.** No testnet, signet, or regtest.
 - **Container images** (see also the package manifest): the `spaced` runtime uses
-  `horologger/spaces:v0.3.0`; Subspaces, Certrelay, and Nacho use
-  `horologger/subs:v0.1.2c`, `horologger/certrelay:v0.2.8`, and
+  `horologger/spaces:v0.3.1`; Subspaces, Certrelay, and Nacho use
+  `horologger/subs:v0.1.2d`, `horologger/certrelay:v0.2.8`, and
   `horologger/nacho:v1.0.0b`.
 - The image's `docker_entrypoint.sh` is not used. `spaced` is managed by
   StartOS, not started inside a `screen` session by login.
diff --git a/startos/manifest/index.ts b/startos/manifest/index.ts
index 6618541..403b795 100644
--- a/startos/manifest/index.ts
+++ b/startos/manifest/index.ts
@@ -14,11 +14,11 @@ export const manifest = setupManifest({
   volumes: ['main'],
   images: {
     spaces: {
-      source: { dockerTag: 'horologger/spaces:v0.3.0' },
+      source: { dockerTag: 'horologger/spaces:v0.3.1' },
       arch: ['x86_64', 'aarch64'],
     },
     subspaces: {
-      source: { dockerTag: 'horologger/subs:v0.1.2c' },
+      source: { dockerTag: 'horologger/subs:v0.1.2d' },
       arch: ['x86_64', 'aarch64'],
     },
     certrelay: {
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index 62c671a..fe9a6f5 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -1,9 +1,9 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '0.3.0:1',
+  version: '0.3.1:0',
   releaseNotes: {
-    en_US: `Group actions on the Actions and Config page (Space-CLI Web UI, Bitcoin, Spaced, Subspaces, Certrelay, Nacho, etc.). Build \`x86\` + \`arm\` only (drop riscv from default \`ARCHES\`).
+    en_US: `Update to upstream Spaces **0.3.1** (\`horologger/spaces:v0.3.1\`). Also bundles \`subs:v0.1.2d\` (\`certrelay:v0.2.8\` and \`nacho:v1.0.0b\` unchanged).
 
 Requires StartOS 0.4.0-beta.10 (\`start-sdk\` 2.0.9).`,
   },