diff --git a/AGENTS.md b/AGENTS.md
index 843abeae..6754f4a6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -142,7 +142,7 @@ test-scripts` fails while the committed file differs from a fresh render, and `m
 lint-alloy` validates and runs it.
 
 **Pinned upstream releases.** One decdn/decdn release line (`decdn_node_version`, today
-`0.1`) and one decdn/sponsord release line (`sponsord_version` = `sponsord_onramp_version`,
+`0.2`) and one decdn/sponsord release line (`sponsord_version` = `sponsord_onramp_version`,
 today `0.1`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
 tags) are pinned across every path. A line, `X.Y`, is what the role defaults, the
 onramp's installer pin (`sponsord_onramp_decdn_release`, `vX.Y`) and the chart's
diff --git a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
index 7b1d476c..8ab8a898 100644
--- a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -36,6 +36,6 @@
 # role's sponsord_onramp_decdn_release line (decdn/decdn, the decdn_node role's default
 # line; a host's decdn_node_version does not move it), with the SHA-256 of its
 # verified SHA256SUMS, on each deploy. To serve one exact release, set its tag and digest:
-# sponsord_onramp_decdn_release: v0.1.0
+# sponsord_onramp_decdn_release: v0.2.0
 # sponsord_onramp_decdn_sums_sha256: "…"
 # CapacityBond and SlashJudge come from sponsord_network (group_vars/sponsord_hosts.yml).
diff --git a/ansible/inventory/host_vars/decdn-node-1/main.yml b/ansible/inventory/host_vars/decdn-node-1/main.yml
index 4ec52092..fd155bc6 100644
--- a/ansible/inventory/host_vars/decdn-node-1/main.yml
+++ b/ansible/inventory/host_vars/decdn-node-1/main.yml
@@ -24,13 +24,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/ansible/inventory/host_vars/origin-1/main.yml b/ansible/inventory/host_vars/origin-1/main.yml
index 1b0b93e1..0fe88bd8 100644
--- a/ansible/inventory/host_vars/origin-1/main.yml
+++ b/ansible/inventory/host_vars/origin-1/main.yml
@@ -26,13 +26,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/ansible/roles/decdn_node/defaults/main.yml b/ansible/roles/decdn_node/defaults/main.yml
index 14cfa96e..b46fecb5 100644
--- a/ansible/roles/decdn_node/defaults/main.yml
+++ b/ansible/roles/decdn_node/defaults/main.yml
@@ -64,7 +64,7 @@ decdn_rustup_sha256:
 # default is the line this repo is synced against; a new line also moves the
 # generated mirrors, the onramp's decdn pin and the chart's appVersion (README.md,
 # "Bumping the decdn release").
-decdn_node_version: "0.1"
+decdn_node_version: "0.2"
 # Release target triple. Derived from the host's gathered architecture (x86_64 or
 # aarch64, see vars/main/arch.yml), so arm64 hosts (Graviton, Ampere, Hetzner CAX)
 # get the aarch64 tarball with no inventory change. Needs facts: a play with
diff --git a/ansible/roles/decdn_node/vars/main/networks.yml b/ansible/roles/decdn_node/vars/main/networks.yml
index 49a770ab..e968723a 100644
--- a/ansible/roles/decdn_node/vars/main/networks.yml
+++ b/ansible/roles/decdn_node/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
+# Source: decdn/decdn @ 5c830ea2dae90c99410097192b558b3ac970ccc4
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/ansible/roles/sponsord/vars/main/networks.yml b/ansible/roles/sponsord/vars/main/networks.yml
index b0a04057..770e4d70 100644
--- a/ansible/roles/sponsord/vars/main/networks.yml
+++ b/ansible/roles/sponsord/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
+# Source: decdn/decdn @ 5c830ea2dae90c99410097192b558b3ac970ccc4
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/ansible/roles/sponsord_onramp/defaults/main.yml b/ansible/roles/sponsord_onramp/defaults/main.yml
index d47dc8be..bbd89a3e 100644
--- a/ansible/roles/sponsord_onramp/defaults/main.yml
+++ b/ansible/roles/sponsord_onramp/defaults/main.yml
@@ -146,7 +146,7 @@ sponsord_onramp_gate_template_src: ""
 # verified against sponsord_onramp_decdn_keyring first. An exact tag, "vX.Y.Z",
 # needs that digest set beside it (`sha256sum SHA256SUMS` after verifying its .asc);
 # preflight refuses a tag without one and a line with one.
-sponsord_onramp_decdn_release: v0.1       # decdn/decdn line or tag
+sponsord_onramp_decdn_release: v0.2       # decdn/decdn line or tag
 sponsord_onramp_decdn_sums_sha256: ""     # with a tag only
 sponsord_onramp_decdn_release_index: "https://api.github.com/repos/decdn/decdn/releases?per_page=100"
 # Where the role reads a line's SHA256SUMS: the installers' own download location
diff --git a/ansible/roles/sponsord_onramp/vars/main/networks.yml b/ansible/roles/sponsord_onramp/vars/main/networks.yml
index 63f107b2..9a228c79 100644
--- a/ansible/roles/sponsord_onramp/vars/main/networks.yml
+++ b/ansible/roles/sponsord_onramp/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
+# Source: decdn/decdn @ 5c830ea2dae90c99410097192b558b3ac970ccc4
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/charts/decdn-node/Chart.yaml b/charts/decdn-node/Chart.yaml
index 634540d6..8a953787 100644
--- a/charts/decdn-node/Chart.yaml
+++ b/charts/decdn-node/Chart.yaml
@@ -15,7 +15,7 @@ version: 0.2.0
 # restarted pod runs the newest). Keep it equal to the decdn_node role's
 # decdn_node_version, and the tag of the one image in the artifacthub.io/images
 # annotation below (make test-scripts checks both).
-appVersion: "0.1"
+appVersion: "0.2"
 kubeVersion: ">=1.25.0-0"
 home: https://decdn.org
 icon: https://decdn.org/icon.svg
@@ -39,7 +39,7 @@ annotations:
   artifacthub.io/license: MIT
   artifacthub.io/images: |
     - name: decdn-node
-      image: ghcr.io/decdn/decdn-node:0.1
+      image: ghcr.io/decdn/decdn-node:0.2
   artifacthub.io/links: |
     - name: Chart source
       url: https://github.com/decdn/devops/tree/main/charts/decdn-node
diff --git a/charts/decdn-node/values.yaml b/charts/decdn-node/values.yaml
index c4ff8f7a..f3f2036c 100644
--- a/charts/decdn-node/values.yaml
+++ b/charts/decdn-node/values.yaml
@@ -14,8 +14,8 @@ image:
   tag: ""
   # sha256:... — takes precedence over tag when set. Prefer it: a tag can be moved.
   # Take it from the release's signed decdn-node-image-digest.txt (v0.0.1:
-  # image-digest.txt), e.g. for v0.1.0
-  # sha256:848532722735b4a115aca9606230d951c25f2dab06a7345305ecf67c7a0244b5
+  # image-digest.txt), e.g. for v0.2.0
+  # sha256:03a9f2e1167db31bb9a95af0b6672916300f86191a41db75db4c568c94899e60
   digest: ""
   # "" picks Always for a release-line tag (X.Y, the default), so a restarted pod
   # pulls the newest release in it rather than whatever the node cached first, and
diff --git a/cloud-init/user-data-publisher.yaml b/cloud-init/user-data-publisher.yaml
index a8b68767..999c0232 100644
--- a/cloud-init/user-data-publisher.yaml
+++ b/cloud-init/user-data-publisher.yaml
@@ -143,7 +143,7 @@ write_files:
           # the digest read from it. To serve one exact release, set its tag with the
           # SHA-256 of its SHA256SUMS (`sha256sum SHA256SUMS` once its SHA256SUMS.asc
           # verifies), e.g.:
-          # sponsord_onramp_decdn_release: "v0.1.0"
+          # sponsord_onramp_decdn_release: "v0.2.0"
           # sponsord_onramp_decdn_sums_sha256: "<64 lowercase hex>"
 
   # What an interactive login prints while the bootstrap is unfinished. It is written
diff --git a/compose/.env.example b/compose/.env.example
index 0cbea2ff..0739c944 100644
--- a/compose/.env.example
+++ b/compose/.env.example
@@ -29,8 +29,8 @@ COMPOSE_PROFILES=node
 # Compose names one release of it (README.md, the node's "Operate").
 
 # --- node -----------------------------------------------------------------------
-# decdn/decdn v0.1.0
-DECDN_IMAGE_DIGEST=sha256:848532722735b4a115aca9606230d951c25f2dab06a7345305ecf67c7a0244b5
+# decdn/decdn v0.2.0
+DECDN_IMAGE_DIGEST=sha256:03a9f2e1167db31bb9a95af0b6672916300f86191a41db75db4c568c94899e60
 # DECDN_IMAGE_REPO=ghcr.io/decdn/decdn-node
 
 # uid/gid of the host's dedicated `decdn` system account, which owns /var/lib/decdn
diff --git a/compose/sponsord-onramp.env.example b/compose/sponsord-onramp.env.example
index 8145d66a..9b288fa6 100644
--- a/compose/sponsord-onramp.env.example
+++ b/compose/sponsord-onramp.env.example
@@ -22,9 +22,9 @@ ONRAMP_TURNSTILE_SITEKEY=
 # SHA-256 of that release's SHA256SUMS file (`sha256sum SHA256SUMS` once its .asc
 # verifies). The Ansible role serves the newest release of its decdn line; Compose
 # has no resolver, so this names one, the newest when this file last moved:
-# decdn/decdn v0.1.0.
-ONRAMP_DECDN_RELEASE=v0.1.0
-ONRAMP_DECDN_SUMS_SHA256=c88ad5479f31bb0857db2c0205c54b240cbceb33a96724e4f8a288b6d866ab66
+# decdn/decdn v0.2.0.
+ONRAMP_DECDN_RELEASE=v0.2.0
+ONRAMP_DECDN_SUMS_SHA256=f4f0a16f1a3896c729bba21ece023f00cae89bea51369047fa7a03f6c7f088d4
 
 # --- Client address ---------------------------------------------------------------
 # The header the proxy puts the client address in; the onramp rate limits by it.
diff --git a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
index 7b1d476c..8ab8a898 100644
--- a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -36,6 +36,6 @@
 # role's sponsord_onramp_decdn_release line (decdn/decdn, the decdn_node role's default
 # line; a host's decdn_node_version does not move it), with the SHA-256 of its
 # verified SHA256SUMS, on each deploy. To serve one exact release, set its tag and digest:
-# sponsord_onramp_decdn_release: v0.1.0
+# sponsord_onramp_decdn_release: v0.2.0
 # sponsord_onramp_decdn_sums_sha256: "…"
 # CapacityBond and SlashJudge come from sponsord_network (group_vars/sponsord_hosts.yml).
diff --git a/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml b/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
index 4ec52092..fd155bc6 100644
--- a/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
+++ b/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
@@ -24,13 +24,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/examples/collection-fleet/inventory/host_vars/origin-1/main.yml b/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
index 1b0b93e1..0fe88bd8 100644
--- a/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
+++ b/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
@@ -26,13 +26,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual