diff --git a/CHANGELOG.md b/CHANGELOG.md
index 827c62f..12dd232 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ and two reports are only comparable when it matches or the difference is known.
 
 ## Unreleased
 
+- The README's GitHub Action example pins `@v0.4.0`, the latest release, instead of `@v0.2.0`.
 - The README opens with a 63-second explainer video: what the probe measures, the `python:3.12-slim` hardening scores, the Antigravity CLI 1.5.2 and `srt` 0.0.81 measurements, and the Harbor grader control task, with each figure taken from a report in `examples/`.
 - Antigravity CLI 1.5.2 measured, with writes and proxy traffic tested for real by `scripts/check_sandbox_boundaries.py`. Under `--sandbox`, `--dangerously-skip-permissions` now leaves the home directory, its shell startup files and the project writable and scores 100, and the 1.5.1 proxy still accepts tunnels to any hostname. With `proceed-in-sandbox` the score stays 31 and the working directory stays read-only, while files written to the build caches it leaves writable, including `~/.cargo/bin`, persist on the host. `measure_stubbed_agent.py` gains `--script` to run a check in place of the probe.
 - Anthropic's sandbox runtime, `srt` 0.0.81, measured on macOS in four configurations. With `allowWrite ["."]` it leaves Claude Code's project settings files writable, which its documentation describes, and naming them in `denyWrite` protects them.
diff --git a/README.md b/README.md
index 28b20ce..a17a210 100644
--- a/README.md
+++ b/README.md
@@ -171,7 +171,7 @@ Both `--baseline` and `agentsec diff` exit with code 2 and list each finding tha
 GitHub Actions runs the same gate checks in one workflow step by installing `agentsec` from the action's own checkout, so the version pinned in the workflow is the version that measures.
 
 ```yaml
-- uses: binary-knight/agentsec-pack@v0.2.0     # the first release that ships the action
+- uses: binary-knight/agentsec-pack@v0.4.0     # a release tag, which pins the agentsec version
   with:
     image: myagent:${{ github.sha }}
     preset: docker-hardened                    # or leave out and pass `flags:` instead