diff --git a/config.example.yaml b/config.example.yaml
index f48a33da6..470ffaea2 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -1076,10 +1076,13 @@ sandbox:
 #
 #   # Optional: Container image to use (works with both Docker and Apple Container)
 #   # Default: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest
-#   # Recommended: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest (works on both x86_64 and arm64)
-#   # Custom images should extend the default image or implement the same AIO
-#   # sandbox HTTP API used by agent-sandbox. See backend/docs/CONFIGURATION.md.
-#   # image: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest
+#   # The mirror's `:latest` tag is frozen on an old pre-1.9.3 digest that lacks
+#   # the /v1/bash/* routes required-secrets skills need (see #3921/#3922), so
+#   # pin an explicit version instead — recommended: 1.11.0 (multi-arch, works
+#   # on both x86_64 and arm64). Custom images should extend the default image
+#   # or implement the same AIO sandbox HTTP API used by agent-sandbox. See
+#   # backend/docs/CONFIGURATION.md.
+#   # image: enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:1.11.0
 #
 #   # Optional: Base port for sandbox containers (default: 8080)
 #   # port: 8080
diff --git a/scripts/setup-sandbox.sh b/scripts/setup-sandbox.sh
index 2f51f786a..36bd6f69f 100755
--- a/scripts/setup-sandbox.sh
+++ b/scripts/setup-sandbox.sh
@@ -10,13 +10,19 @@ echo ""
 
 # Try to extract image from config.yaml (handles both commented and uncommented sandbox sections)
 IMAGE=""
+CONFIGURED=1
 if [ -f "config.yaml" ]; then
     # Look for uncommented image: field under the sandbox section
     IMAGE=$(grep -A 20 "^sandbox:" config.yaml 2>/dev/null | grep "^  image:" | awk '{print $2}' | head -1 || true)
 fi
 
 if [ -z "$IMAGE" ]; then
-    IMAGE="enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest"
+    # NOTE: not ":latest". The mirror's `:latest` tag is frozen on an old
+    # pre-1.9.3 digest that lacks the /v1/bash/* routes required-secrets
+    # skills need (see #3921/#3922) — pulling it here would defeat the whole
+    # point of this pre-pull helper. Keep this pinned to a version >= 1.9.3.
+    IMAGE="enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:1.11.0"
+    CONFIGURED=0
     echo "Using default image: $IMAGE"
 else
     echo "Using configured image: $IMAGE"
@@ -43,3 +49,15 @@ else
     echo "  Please install Docker: https://docs.docker.com/get-docker/"
     exit 1
 fi
+
+if [ "$CONFIGURED" -eq 0 ]; then
+    echo ""
+    echo "⚠ NOTE: pulling this image does not make the sandbox use it."
+    echo "  config.yaml has no uncommented 'sandbox.image', so AioSandboxProvider"
+    echo "  falls back to its own built-in default at runtime, which is still"
+    echo "  pinned to ':latest' (frozen on an old pre-1.9.3 digest — see #3921)."
+    echo "  To actually run on $IMAGE, add it explicitly:"
+    echo ""
+    echo "    sandbox:"
+    echo "      image: $IMAGE"
+fi