diff --git a/docs/architecture/hooks.md b/docs/architecture/hooks.md
index a504549..be5cc75 100644
--- a/docs/architecture/hooks.md
+++ b/docs/architecture/hooks.md
@@ -68,9 +68,10 @@ The sandbox filesystem is an `internal/mountfs` composite of two mounts:
 
 A write outside `/tmp` fails, and a redirect into `/src` aborts the script.
 
-`internal/kefkash` vendors the unexported `billysh` handler wiring from kefka.
-Its `OpenHandler` is adapted to permit writes, so `/tmp` redirections work.
-The filesystem is what enforces the read-only `/src`.
+`internal/kefkash` mirrors kefka's `billysh` handler wiring, which was
+internal when it was vendored. Its `OpenHandler` is adapted to permit writes,
+so `/tmp` redirections work. The filesystem is what enforces the read-only
+`/src`.
 `internal/mountfs` also provides read-only directory handles for the WASI
 programs, which need to open `/` and directories below it to resolve paths.
 Open files report their full mounted path so WASI can stat them after open.
diff --git a/go.mod b/go.mod
index b2fc311..127b0a2 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.26.3
 
 require (
 	github.com/Xe/erofs v0.8.0
-	github.com/Xe/kefka v0.1.2
+	github.com/Xe/kefka v0.2.0
 	github.com/aws/aws-sdk-go-v2 v1.41.7
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.102.0
 	github.com/aws/smithy-go v1.26.0
diff --git a/go.sum b/go.sum
index 76e76f0..ad7e44c 100644
--- a/go.sum
+++ b/go.sum
@@ -6,8 +6,8 @@ github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/Xe/erofs v0.8.0 h1:OSD900oSKFP91cM+RyCTXW0FyamjtpwA5jTGLEeyxuw=
 github.com/Xe/erofs v0.8.0/go.mod h1:GGxvJkCKU4yKfJ+Trap2xC8iN0HGuTUEsD5oz+olLJI=
-github.com/Xe/kefka v0.1.2 h1:/kMg+glM3w01AulP20PNszIntNtoNmFd3bHsbFLICl8=
-github.com/Xe/kefka v0.1.2/go.mod h1:22dif/zXQZvScR1WPA8ZERvyREtx/cScRlxNs7o55V8=
+github.com/Xe/kefka v0.2.0 h1:YXfeAlwxGFvljPX6CK7gqa8XVtLK9SS+K6LGo2gklGU=
+github.com/Xe/kefka v0.2.0/go.mod h1:22dif/zXQZvScR1WPA8ZERvyREtx/cScRlxNs7o55V8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
diff --git a/internal/kefkash/kefkash.go b/internal/kefkash/kefkash.go
index cefe4fd..87bea9f 100644
--- a/internal/kefkash/kefkash.go
+++ b/internal/kefkash/kefkash.go
@@ -1,8 +1,8 @@
 // Package kefkash wires a billy.Filesystem into an mvdan.cc/sh interpreter the
-// way the kefka virtual shell does. The handler constructors are vendored from
-// kefka's internal/billysh (github.com/Xe/kefka), which is not importable
-// because it lives under internal/. They depend only on kefka's public
-// command/registry package.
+// way the kefka virtual shell does. The handler constructors mirror kefka's
+// billysh package (github.com/Xe/kefka/billysh), which was internal when this
+// package was first vendored. It stays a local fork for the deviation below;
+// importing upstream billysh directly would break /tmp redirections.
 //
 // One deliberate deviation from upstream: FsysOpenHandler permits write opens
 // and delegates them to the filesystem's OpenFile. objgit hands the sandbox a