diff --git a/DOCKER_README.md b/DOCKER_README.md
index eb1eb7bf1..051301f28 100644
--- a/DOCKER_README.md
+++ b/DOCKER_README.md
@@ -18,7 +18,7 @@ All images are published as tags on `cloudflare/sandbox`:
 These images are designed to be used with the [`@cloudflare/sandbox`](https://www.npmjs.com/package/@cloudflare/sandbox) SDK. Reference them in your project's `Dockerfile`:
 
 ```dockerfile
-FROM cloudflare/sandbox:0.12.8-python
+FROM cloudflare/sandbox:0.12.9-python
 ```
 
 Then configure your `wrangler.toml` to use the image:
diff --git a/bridge/worker/Dockerfile b/bridge/worker/Dockerfile
index b1d0b413c..fedfff973 100644
--- a/bridge/worker/Dockerfile
+++ b/bridge/worker/Dockerfile
@@ -1,6 +1,6 @@
 # Base image provided by Cloudflare — includes the sandbox control-plane server
 # that listens on port 3000 and handles all SDK API calls.
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Install tooling for UC workspace operations and agent use.
 # The base image is Debian-based and includes sh, ls, rm, mkdir, cp, etc.
diff --git a/bridge/worker/README.md b/bridge/worker/README.md
index 25644b4dc..4774fcef0 100644
--- a/bridge/worker/README.md
+++ b/bridge/worker/README.md
@@ -57,7 +57,7 @@ The default configuration uses `"lite"` instances with `max_instances: 3`. This
 The bridge worker depends on two versioned artifacts that should be kept in sync:
 
 1. **`@cloudflare/sandbox`** — the SDK package in `package.json`. Bump the version (or use `"*"` to track latest) and run `npm install`.
-2. **`cloudflare/sandbox` Docker image** — the base image tag in `Dockerfile` (e.g. `FROM docker.io/cloudflare/sandbox:0.12.8`). Update the tag to match the SDK version.
+2. **`cloudflare/sandbox` Docker image** — the base image tag in `Dockerfile` (e.g. `FROM docker.io/cloudflare/sandbox:0.12.9`). Update the tag to match the SDK version.
 
 Both versions should match — the SDK and container image are released together. After updating:
 
diff --git a/examples/alpine/Dockerfile b/examples/alpine/Dockerfile
index e9a0c0b5e..246c26c07 100644
--- a/examples/alpine/Dockerfile
+++ b/examples/alpine/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8-musl
+FROM docker.io/cloudflare/sandbox:0.12.9-musl
 
 # Documents the ports this application uses (standard Docker convention)
 EXPOSE 8080
diff --git a/examples/authentication/Dockerfile b/examples/authentication/Dockerfile
index bf080252c..809ff40df 100644
--- a/examples/authentication/Dockerfile
+++ b/examples/authentication/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Documents the ports this application uses (standard Docker convention)
 EXPOSE 8080
diff --git a/examples/claude-code/Dockerfile b/examples/claude-code/Dockerfile
index 32c640700..e6e6c8071 100644
--- a/examples/claude-code/Dockerfile
+++ b/examples/claude-code/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 RUN npm install -g @anthropic-ai/claude-code
 ENV COMMAND_TIMEOUT_MS=300000
 EXPOSE 3000
diff --git a/examples/code-interpreter/Dockerfile b/examples/code-interpreter/Dockerfile
index 4ce0cec70..70e25d0f3 100644
--- a/examples/code-interpreter/Dockerfile
+++ b/examples/code-interpreter/Dockerfile
@@ -1 +1 @@
-FROM docker.io/cloudflare/sandbox:0.12.8-python
+FROM docker.io/cloudflare/sandbox:0.12.9-python
diff --git a/examples/codex-app-server/Dockerfile b/examples/codex-app-server/Dockerfile
index 62ef601bb..b83d57673 100644
--- a/examples/codex-app-server/Dockerfile
+++ b/examples/codex-app-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Install the Codex CLI globally
 RUN npm install -g @openai/codex
diff --git a/examples/codex-app-server/README.md b/examples/codex-app-server/README.md
index 420976eb2..990bec81a 100644
--- a/examples/codex-app-server/README.md
+++ b/examples/codex-app-server/README.md
@@ -184,7 +184,7 @@ When deployed with `interceptHttps = true`, HTTPS requests to blocked hosts also
 
 ```
 codex-app-server/
-├── Dockerfile               cloudflare/sandbox:0.12.8 + @openai/codex CLI
+├── Dockerfile               cloudflare/sandbox:0.12.9 + @openai/codex CLI
 ├── wrangler.jsonc            Worker + Sandbox Durable Object + container config
 ├── .dev.vars.example         Environment variable template
 ├── src/
diff --git a/examples/codex/Dockerfile b/examples/codex/Dockerfile
index 86a8e24bf..7053b18f6 100644
--- a/examples/codex/Dockerfile
+++ b/examples/codex/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 RUN npm install -g @openai/codex
 ENV COMMAND_TIMEOUT_MS=300000
 EXPOSE 3000
diff --git a/examples/collaborative-terminal/Dockerfile b/examples/collaborative-terminal/Dockerfile
index bf080252c..809ff40df 100644
--- a/examples/collaborative-terminal/Dockerfile
+++ b/examples/collaborative-terminal/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Documents the ports this application uses (standard Docker convention)
 EXPOSE 8080
diff --git a/examples/git-repo-per-sandbox/Dockerfile b/examples/git-repo-per-sandbox/Dockerfile
index bf080252c..809ff40df 100644
--- a/examples/git-repo-per-sandbox/Dockerfile
+++ b/examples/git-repo-per-sandbox/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Documents the ports this application uses (standard Docker convention)
 EXPOSE 8080
diff --git a/examples/minimal/Dockerfile b/examples/minimal/Dockerfile
index bf080252c..809ff40df 100644
--- a/examples/minimal/Dockerfile
+++ b/examples/minimal/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Documents the ports this application uses (standard Docker convention)
 EXPOSE 8080
diff --git a/examples/openai-agents/Dockerfile b/examples/openai-agents/Dockerfile
index 00d3adf2b..8e5496901 100644
--- a/examples/openai-agents/Dockerfile
+++ b/examples/openai-agents/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Documents the ports this application uses (standard Docker convention)
 EXPOSE 8080
diff --git a/examples/opencode/Dockerfile b/examples/opencode/Dockerfile
index 08c186251..1f680fea3 100644
--- a/examples/opencode/Dockerfile
+++ b/examples/opencode/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8-opencode
+FROM docker.io/cloudflare/sandbox:0.12.9-opencode
 
 # Clone sample project for the web UI to work with
 RUN git clone --depth 1 https://github.com/cloudflare/agents.git /home/user/agents
diff --git a/examples/s3-mount/Dockerfile b/examples/s3-mount/Dockerfile
index f442cd4ac..5648f262d 100644
--- a/examples/s3-mount/Dockerfile
+++ b/examples/s3-mount/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # mount-s3 (mountpoint-s3) — pinned version with SHA-256 verification per architecture
 ARG MOUNT_S3_VERSION=1.22.3
diff --git a/examples/time-machine/Dockerfile b/examples/time-machine/Dockerfile
index bf080252c..809ff40df 100644
--- a/examples/time-machine/Dockerfile
+++ b/examples/time-machine/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Documents the ports this application uses (standard Docker convention)
 EXPOSE 8080
diff --git a/examples/typescript-validator/Dockerfile b/examples/typescript-validator/Dockerfile
index f31e8eb75..fdaa2bc7a 100644
--- a/examples/typescript-validator/Dockerfile
+++ b/examples/typescript-validator/Dockerfile
@@ -1,5 +1,5 @@
 # Use Cloudflare sandbox as base
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 # Install esbuild for TypeScript bundling
 RUN npm install -g esbuild
diff --git a/examples/vite-sandbox/Dockerfile b/examples/vite-sandbox/Dockerfile
index 0df3945a2..da2bc4ad4 100644
--- a/examples/vite-sandbox/Dockerfile
+++ b/examples/vite-sandbox/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 WORKDIR /app
 COPY sandbox-app/package.json ./
diff --git a/examples/websocket-tunnel/Dockerfile b/examples/websocket-tunnel/Dockerfile
index 5244aeb7f..a24134dfa 100644
--- a/examples/websocket-tunnel/Dockerfile
+++ b/examples/websocket-tunnel/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/cloudflare/sandbox:0.12.8
+FROM docker.io/cloudflare/sandbox:0.12.9
 
 COPY server.js /app/server.js