diff --git a/docs/configuration/overview/index.md b/docs/configuration/overview/index.md
index 8579b0d306..253da9dc97 100644
--- a/docs/configuration/overview/index.md
+++ b/docs/configuration/overview/index.md
@@ -19,7 +19,7 @@ A docker-agent config has these main sections:
 
 ```bash
 # 1. Version — configuration schema version (optional but recommended)
-version: 10
+version: 12
 
 # 2. Metadata — optional agent metadata for distribution
 metadata:
@@ -294,10 +294,10 @@ For YAML editor autocompletion and validation, use the [Docker Agent JSON Schema
 
 ## Config Versioning
 
-docker-agent configs are versioned. The current version is `10`. Add the version at the top of your config:
+docker-agent configs are versioned. The current version is `12`. Add the version at the top of your config:
 
 ```yaml
-version: 10
+version: 12
 
 agents:
   root:
@@ -307,6 +307,14 @@ agents:
 
 When you load an older config, docker-agent automatically migrates it to the latest schema. It's recommended to include the version to ensure consistent behavior.
 
+If you use a config key that requires a newer schema version, Docker Agent will fail with a strict-parse error and include a hint like:
+
+```text
+hint: this key is supported by config version 12; update the top-level 'version' field (currently 11)
+```
+
+Bump the `version` field as directed to enable the new key.
+
 ## Metadata Section
 
 Optional metadata for agent distribution via OCI registries:
diff --git a/docs/configuration/sandbox/index.md b/docs/configuration/sandbox/index.md
index 3b0cce75a8..3e1bca4269 100644
--- a/docs/configuration/sandbox/index.md
+++ b/docs/configuration/sandbox/index.md
@@ -166,6 +166,12 @@ docker agent run --sandbox agent.yaml
 6. All tools (shell, filesystem, background jobs, etc.) run inside the VM.
 7. When the session ends, docker-agent exits but does not stop or remove the sandbox VM; both the VM and the kit are kept around so subsequent runs from the same workspace can reuse them. A fresh sandbox is created only when the mount set has changed.
 
+### What the default template includes
+
+The default template (`docker/sandbox-templates:docker-agent`) ships with:
+
+- **`docker-mcp`** CLI plugin — installed at `~/.docker/cli-plugins/docker-mcp`, available out of the box so agents can invoke `docker mcp` commands inside the sandbox without any additional setup.
+
 ## Auto-Kit
 
 The sandbox VM has its own filesystem and `$HOME` — none of the host's `~/.agents/skills/`, `~/.claude/skills/`, project-level `.agents/skills/`, or prompt files like `AGENTS.md` and `CLAUDE.md` are visible inside it. To bridge that gap, docker-agent automatically builds a **kit**: a self-contained directory staged on the host before the sandbox starts and bind-mounted read-only into the VM at the same path.