diff --git a/AGENTS.md b/AGENTS.md
index 20edca2..092002c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -143,7 +143,7 @@ lint-alloy` validates and runs it.
 
 **Pinned upstream releases.** One decdn/decdn release (`decdn_node_version`, today
 `0.0.4`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
-today `0.0.4`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
+today `0.1.0`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
 tags) are pinned across every path: the role defaults, the onramp's installer pin
 (`sponsord_onramp_decdn_release` + `_decdn_sums_sha256`, copied into
 `compose/sponsord-onramp.env.example`), `compose/.env.example`'s image digests, the
diff --git a/ansible/inventory/group_vars/sponsord_hosts.yml b/ansible/inventory/group_vars/sponsord_hosts.yml
index 6680a40..7c86e36 100644
--- a/ansible/inventory/group_vars/sponsord_hosts.yml
+++ b/ansible/inventory/group_vars/sponsord_hosts.yml
@@ -14,11 +14,11 @@
 # The default method, "release", installs the decdn/sponsord release the role pins
 # (tag v<sponsord_version>); set it only to hold the host on another one, together
 # with sponsord_onramp_version:
-# sponsord_version: "0.0.4"
+# sponsord_version: "0.1.0"
 # Or build on the host from a git ref (tag, branch or SHA; sponsord_version is not
 # checked in this mode):
 # sponsord_install_method: source
-# sponsord_source_ref: v0.0.4
+# sponsord_source_ref: v0.1.0
 # Or copy a control-machine build: a decdn/sponsord checkout's target dir
 # (`cargo build --release -p sponsord`; the role checks the ELF matches the host).
 # sponsord_install_method: manual
diff --git a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
index fab1c96..dbf148d 100644
--- a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -12,10 +12,10 @@
 # --- Binary ------------------------------------------------------------------------
 # The same three methods as sponsord. "release" (default) installs the same release
 # as the sponsord role; set both versions together to hold the host on another:
-# sponsord_onramp_version: "0.0.4"
+# sponsord_onramp_version: "0.1.0"
 # Or build on the host (its own checkout, so it may pin a different ref):
 # sponsord_onramp_install_method: source
-# sponsord_onramp_source_ref: v0.0.4
+# sponsord_onramp_source_ref: v0.1.0
 # Or manual, which follows sponsord_release_target_dir (`cargo build --release` in
 # a decdn/sponsord checkout builds both binaries):
 # sponsord_onramp_install_method: manual
diff --git a/ansible/roles/decdn_node/defaults/main.yml b/ansible/roles/decdn_node/defaults/main.yml
index a17a53e..0647a52 100644
--- a/ansible/roles/decdn_node/defaults/main.yml
+++ b/ansible/roles/decdn_node/defaults/main.yml
@@ -179,7 +179,7 @@ decdn_redeem_max_vouchers_per_tx: ""     # daemon dflt 300; > 0 — gas-bounded
 decdn_redeem_interval_secs: ""           # daemon dflt 300; range 1..=21600 — redeemer self-tick
 decdn_buyer_working_deposit_micro_usdc: ""  # daemon dflt 10_000_000 (10 USDC); > 0
 # bool; profile-dependent upstream — true for the daemon, false for the `decdn`
-# client (fetch / bundle pull). node.toml is deliberately shared with the CLI, so
+# client (decdn get). node.toml is deliberately shared with the CLI, so
 # pinning it here changes client behaviour too. One-time max USDC approval to PaymentPool.
 decdn_buyer_max_approve: ""
 decdn_pool_min_remaining_deposit_micro_usdc: ""  # daemon dflt 1_000_000 — solvency floor before a pool drains
diff --git a/ansible/roles/iroh_relay/README.md b/ansible/roles/iroh_relay/README.md
index 0cdfc0a..c6c1bf1 100644
--- a/ansible/roles/iroh_relay/README.md
+++ b/ansible/roles/iroh_relay/README.md
@@ -122,7 +122,7 @@ decdn_relay_urls:
 Setting `decdn_relay_urls` **replaces** n0's relays; it does not add to them. A node
 whose only relay is down has no fallback for peers it cannot hole-punch. Deploy
 **at least two** relays, preferably in different regions, before switching a fleet
-over. Clients (`decdn fetch`, `decdn probe --relay-url …`) take relays the same way,
+over. Clients (`decdn get`, `decdn probe --relay-url …`) take relays the same way,
 but a relay in the default `allowlist` mode refuses them (see below): point clients
 only at relays in `everyone` or `denylist` mode.
 
@@ -155,7 +155,7 @@ anyone in every mode.
 - **`denylist`:** everyone except `iroh_relay_denylist`.
 - **`everyone`:** no restriction.
 
-**What allowlist mode costs.** decdn clients (`decdn fetch`, `decdn probe`, onramp
+**What allowlist mode costs.** decdn clients (`decdn get`, `decdn probe`, onramp
 users) use a fresh iroh key for every fetch, so they **can never be listed**. iroh
 hole-punches over a connection it already has, and a node behind NAT has no path
 but its relay, so a client reaches a node homed on an allowlisted relay **only if
diff --git a/ansible/roles/iroh_relay/defaults/main.yml b/ansible/roles/iroh_relay/defaults/main.yml
index 60e92cd..fbf1334 100644
--- a/ansible/roles/iroh_relay/defaults/main.yml
+++ b/ansible/roles/iroh_relay/defaults/main.yml
@@ -69,7 +69,7 @@ iroh_relay_metrics_port: 9092
 # anyone in every mode):
 #   "allowlist" (default): only the endpoint IDs below. The IDs of the inventory's
 #     deCDN nodes are added by playbooks/iroh_relay.yml (iroh_relay_allowlist_from_inventory).
-#     decdn clients (decdn fetch, onramp users) use a fresh key per fetch and can
+#     decdn clients (decdn get, onramp users) use a fresh key per fetch and can
 #     NEVER be listed, and iroh hole-punches over a connection it already has, so a
 #     client reaches a node homed here only if the node is directly reachable. A
 #     node behind NAT that serves clients needs its relays in "everyone" mode.
diff --git a/ansible/roles/sponsord/defaults/main.yml b/ansible/roles/sponsord/defaults/main.yml
index 8914d1a..d00b982 100644
--- a/ansible/roles/sponsord/defaults/main.yml
+++ b/ansible/roles/sponsord/defaults/main.yml
@@ -52,7 +52,7 @@ decdn_rustup_sha256:
 # The decdn/sponsord release (tag v<version>) this repo pins. Keep it equal to
 # sponsord_onramp_version: both come from one workspace release (README.md,
 # "Bumping the sponsord release"; make test-scripts checks the defaults agree).
-sponsord_version: "0.0.4"         # asserted non-empty in "release" mode
+sponsord_version: "0.1.0"         # asserted non-empty in "release" mode
 # Release target triple, derived from the host's gathered architecture (see
 # vars/main/arch.yml). Set it explicitly only for a play with gather_facts: false.
 sponsord_target: "{{ _sponsord_arch_targets.get(ansible_facts.get('architecture', ''), '') }}"
diff --git a/ansible/roles/sponsord_onramp/README.md b/ansible/roles/sponsord_onramp/README.md
index bf1b2e5..b23a555 100644
--- a/ansible/roles/sponsord_onramp/README.md
+++ b/ansible/roles/sponsord_onramp/README.md
@@ -7,7 +7,7 @@ the public side of the deCDN onboarding sponsor. It serves:
   their download;
 - the `decdn.sh` / `decdn.ps1` installers, which install `decdn` from a pinned
   release, make a throwaway download key, get the capability through the gate and
-  run `decdn bundle pull` with it;
+  run `decdn get` with it;
 - the API the installers poll for that capability.
 
 It holds no wallet. For each person who passes the gate it asks the
diff --git a/ansible/roles/sponsord_onramp/defaults/main.yml b/ansible/roles/sponsord_onramp/defaults/main.yml
index 6ea2caa..e98e410 100644
--- a/ansible/roles/sponsord_onramp/defaults/main.yml
+++ b/ansible/roles/sponsord_onramp/defaults/main.yml
@@ -50,7 +50,7 @@ decdn_rustup_sha256:
 # --- Release to install ("release" mode) ----------------------------------------
 # The decdn/sponsord release (tag v<version>) this repo pins, the
 # same one as the sponsord role's sponsord_version.
-sponsord_onramp_version: "0.0.4"         # asserted non-empty in "release" mode
+sponsord_onramp_version: "0.1.0"         # asserted non-empty in "release" mode
 # Derived from the host's gathered architecture (vars/main/arch.yml).
 sponsord_onramp_target: "{{ _sponsord_onramp_arch_targets.get(ansible_facts.get('architecture', ''), '') }}"
 sponsord_onramp_release_base: "https://github.com/decdn/sponsord/releases/download"
diff --git a/compose/.env.example b/compose/.env.example
index bca4c88..e69c100 100644
--- a/compose/.env.example
+++ b/compose/.env.example
@@ -42,9 +42,9 @@ DECDN_ENV_FILE=/etc/decdn/decdn.env
 
 # --- sponsord and onramp ----------------------------------------------------------
 # The decdn/sponsord release sponsord_version pins: one release for both images
-SPONSORD_IMAGE_DIGEST=sha256:120982625257b28cf785c776cb2cc7a6c6cd8e2e5958b274f1a43d27ab857eea
+SPONSORD_IMAGE_DIGEST=sha256:8f82f8f88ce75be0072abc8f72e0462e03c0afba8035fe8671d6ee79ebbc930b
 # SPONSORD_IMAGE_REPO=ghcr.io/decdn/sponsord
-SPONSORD_ONRAMP_IMAGE_DIGEST=sha256:76362c0de04d3febf43b39ee1d00bd29d45a1b4338fc3f8fb0427d52d5b13805
+SPONSORD_ONRAMP_IMAGE_DIGEST=sha256:f0a2701a717c9cdd0ec0969866be30ccbf82773e08c7f25405413f543281a2df
 # SPONSORD_ONRAMP_IMAGE_REPO=ghcr.io/decdn/sponsord-onramp
 
 # uid/gid of the host's dedicated `sponsord` system account, which owns the
diff --git a/compose/README.md b/compose/README.md
index f7901e4..ea9e771 100644
--- a/compose/README.md
+++ b/compose/README.md
@@ -398,7 +398,7 @@ udp/7842 itself, so it cannot share a host with `onramp`, `caddy` or `dns`.
      `decdn whoami` as the node's user) and add each `node id` to `access` in the
      config. `check` refuses an empty list, which would admit nobody. Update every
      relay after adding a node or rotating its key, then `restart iroh-relay`.
-   - **What it costs:** decdn clients (`decdn fetch`, onramp users) use a fresh key
+   - **What it costs:** decdn clients (`decdn get`, onramp users) use a fresh key
      per fetch, so they can never be listed, and iroh hole-punches over a connection
      it already has. A client therefore reaches a node homed on an allowlisted relay
      only if the node is directly reachable. A node behind NAT that serves clients
diff --git a/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml b/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml
index 6680a40..7c86e36 100644
--- a/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml
+++ b/examples/collection-fleet/inventory/group_vars/sponsord_hosts.yml
@@ -14,11 +14,11 @@
 # The default method, "release", installs the decdn/sponsord release the role pins
 # (tag v<sponsord_version>); set it only to hold the host on another one, together
 # with sponsord_onramp_version:
-# sponsord_version: "0.0.4"
+# sponsord_version: "0.1.0"
 # Or build on the host from a git ref (tag, branch or SHA; sponsord_version is not
 # checked in this mode):
 # sponsord_install_method: source
-# sponsord_source_ref: v0.0.4
+# sponsord_source_ref: v0.1.0
 # Or copy a control-machine build: a decdn/sponsord checkout's target dir
 # (`cargo build --release -p sponsord`; the role checks the ELF matches the host).
 # sponsord_install_method: manual
diff --git a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
index fab1c96..dbf148d 100644
--- a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -12,10 +12,10 @@
 # --- Binary ------------------------------------------------------------------------
 # The same three methods as sponsord. "release" (default) installs the same release
 # as the sponsord role; set both versions together to hold the host on another:
-# sponsord_onramp_version: "0.0.4"
+# sponsord_onramp_version: "0.1.0"
 # Or build on the host (its own checkout, so it may pin a different ref):
 # sponsord_onramp_install_method: source
-# sponsord_onramp_source_ref: v0.0.4
+# sponsord_onramp_source_ref: v0.1.0
 # Or manual, which follows sponsord_release_target_dir (`cargo build --release` in
 # a decdn/sponsord checkout builds both binaries):
 # sponsord_onramp_install_method: manual