diff --git a/sandbox/README.md b/sandbox/README.md
index 3e183db3..1984db34 100644
--- a/sandbox/README.md
+++ b/sandbox/README.md
@@ -17,10 +17,6 @@ The API lands on <http://127.0.0.1:18000>. Postgres is on 15432 and Redis on 163
 deliberately off the defaults, so the sandbox coexists with a normal local stack instead of
 fighting it for ports and volumes.
 
-> **Right now you need `--build`.** The mock provider comes from PR #1094, which is not merged, so
-> no published image contains it. `sandbox.sh` checks and tells you. Once #1094 lands and an image
-> is published, bump the digest in `image.env` and plain `up` works.
-
 ## Provider modes
 
 The deriver calls a model provider, which is what made a sandbox neither free nor deterministic.
diff --git a/sandbox/compose.mock.yml b/sandbox/compose.mock.yml
index 55fa8ea7..4c5f8e77 100644
--- a/sandbox/compose.mock.yml
+++ b/sandbox/compose.mock.yml
@@ -1,6 +1,6 @@
 # Provider overlay: deterministic, free, no network egress. The sandbox default.
 #
-# Adds src/mock_provider (PR #1094) as its own service. It runs from the standard
+# Adds src/mock_provider as its own service. It runs from the standard
 # Honcho image under a different entrypoint, the way api and deriver already differ,
 # so there is no second image to build or keep in digest-sync.
 
diff --git a/sandbox/image.env b/sandbox/image.env
index 32606781..bc7e8b38 100644
--- a/sandbox/image.env
+++ b/sandbox/image.env
@@ -4,13 +4,10 @@
 # machines exercise the same bytes, which a floating tag does not give you.
 #
 # This is the multi-arch index digest (linux/amd64 + linux/arm64), so it resolves on
-# both Apple Silicon and CI.
+# both Apple Silicon and CI. Take it from the index, not a per-platform manifest:
 #
-# NOTE: this digest predates PR #1094, so it does NOT contain src/mock_provider.
-# Until #1094 lands and a new image is published, mock mode needs --build:
+#     docker buildx imagetools inspect ghcr.io/plastic-labs/honcho:latest
 #
-#     sandbox/sandbox.sh up --build
-#
-# sandbox.sh checks for the module and tells you this rather than failing obscurely.
-# When #1094 is merged and published, bump the digest here and drop this note.
-HONCHO_SANDBOX_IMAGE=ghcr.io/plastic-labs/honcho@sha256:3e62ce949cd020155e59d58302e11a20465c79815d80e2d4eecd106e9c8f9ab4
+# The image must contain src/mock_provider, which mock mode runs as its own service.
+# sandbox.sh checks that before starting rather than letting the service crash-loop.
+HONCHO_SANDBOX_IMAGE=ghcr.io/plastic-labs/honcho@sha256:a741e601e2c2fda5af4b6c207946aad45db2a11db05f04c1dc094f998794eae1
diff --git a/sandbox/sandbox.sh b/sandbox/sandbox.sh
index 2f5a19d3..f87ef0a0 100755
--- a/sandbox/sandbox.sh
+++ b/sandbox/sandbox.sh
@@ -116,20 +116,19 @@ preflight() {
   return 0
 }
 
-# The pinned digest predates PR #1094, so it carries no src/mock_provider. Say so
-# precisely instead of letting the service crash-loop on a missing module.
+# Mock mode runs src/mock_provider out of the same image. A digest that predates the
+# module resolves and pulls fine, then crash-loops one service on a missing module —
+# so check for it up front and name the two ways out.
 check_mock_provider_present() {
   [ "$PROVIDER" = mock ] || return 0
   if ! docker run --rm --entrypoint test "$HONCHO_SANDBOX_IMAGE" -d /app/src/mock_provider; then
     die "$(cat <<MSG
 the image $HONCHO_SANDBOX_IMAGE does not contain src/mock_provider.
 
-PR #1094 adds it and is not merged yet, so no published image has it. Build from
-the working tree instead:
+It predates the mock provider. Either bump the digest in sandbox/image.env to an
+image that has it, or build from the working tree:
 
     sandbox/sandbox.sh up --build
-
-Once #1094 is merged and published, bump the digest in sandbox/image.env.
 MSG
 )"
   fi