diff --git a/crates/agent-vm/src/run.rs b/crates/agent-vm/src/run.rs
index b6f3d7c..8d51aea 100644
--- a/crates/agent-vm/src/run.rs
+++ b/crates/agent-vm/src/run.rs
@@ -14,7 +14,7 @@ use std::{
 
 use anyhow::{Context, Result, bail};
 use clap::Args as ClapArgs;
-use microsandbox::Sandbox;
+use microsandbox::{Sandbox, sandbox::PullPolicy};
 
 use crate::session::ProjectSession;
 
@@ -132,9 +132,16 @@ pub async fn launch(agent: Agent, args: Args) -> Result<i32> {
         "/workspace".to_string()
     };
     let mut patch_builder_steps = mkdir_chain(Path::new(&project_guest_path));
+    // PullPolicy::Always: microsandbox's default IfMissing keys its layer
+    // cache by reference, so re-running `agent-vm setup` (which rebuilds
+    // and re-pushes to the same :latest tag) would otherwise boot from the
+    // stale cached manifest. Always re-checks the manifest at the
+    // registry; cached layers whose digests still match are reused, so
+    // the cost is one round-trip + a few bytes when nothing changed.
     let mut builder = Sandbox::builder(&session.sandbox_name)
         .image(image.as_str())
         .registry(|r| r.insecure())
+        .pull_policy(PullPolicy::Always)
         .cpus(cpus)
         .memory(memory_mib)
         .workdir(project_guest_path.clone())
diff --git a/crates/agent-vm/src/setup.rs b/crates/agent-vm/src/setup.rs
index e765541..a382aa1 100644
--- a/crates/agent-vm/src/setup.rs
+++ b/crates/agent-vm/src/setup.rs
@@ -12,7 +12,7 @@ use std::{
 
 use anyhow::{Context, Result, bail};
 use clap::Args as ClapArgs;
-use microsandbox::Sandbox;
+use microsandbox::{Sandbox, sandbox::PullPolicy};
 
 #[derive(ClapArgs)]
 pub struct Args {
@@ -67,9 +67,14 @@ fn build_script_path() -> Result<PathBuf> {
 async fn verify_image(image: &str) -> Result<()> {
     println!("==> Verifying {image}");
     println!("==> Booting throwaway sandbox (this is the first VM cold-start; ~3s on a warm host)");
+    // Pull policy: Always — we just rebuilt + pushed under the same tag,
+    // so the cached manifest is by definition stale. Without this the
+    // verify step boots the *previous* image and quietly attests that an
+    // old version still works.
     let sandbox = Sandbox::builder("agent-vm-setup-verify")
         .image(image)
         .registry(|r| r.insecure())
+        .pull_policy(PullPolicy::Always)
         .cpus(1)
         .memory(512)
         .replace()