diff --git a/charts/suppline/README.md b/charts/suppline/README.md
index 440e4f2..8874c94 100644
--- a/charts/suppline/README.md
+++ b/charts/suppline/README.md
@@ -78,7 +78,7 @@ registry:
   enabled: true
 ```
 
-Do **not** treat the bundled `registry:2` as a long-term production registry. Details: [docs/REGISTRY.md](../../docs/REGISTRY.md).
+Do **not** treat the bundled `registry:3` as a long-term production registry. Details: [docs/REGISTRY.md](../../docs/REGISTRY.md).
 
 ## Uninstall
 
diff --git a/charts/suppline/values-secrets.yaml.example b/charts/suppline/values-secrets.yaml.example
index 71d9e7d..01c4490 100644
--- a/charts/suppline/values-secrets.yaml.example
+++ b/charts/suppline/values-secrets.yaml.example
@@ -24,6 +24,6 @@ backend:
     SUPPLINE_REGISTRY_USERNAME: "suppline"
     SUPPLINE_REGISTRY_PASSWORD: "your-registry-password"
 
-# Optional: enable the chart’s bundled registry:2 for labs only
+# Optional: enable the chart’s bundled registry:3 for labs only
 # registry:
 #   enabled: true
diff --git a/charts/suppline/values.yaml b/charts/suppline/values.yaml
index 7aa4e64..dabc912 100644
--- a/charts/suppline/values.yaml
+++ b/charts/suppline/values.yaml
@@ -252,14 +252,14 @@ imagePullSecrets: []
 # Prefer bring-your-own Harbor/ECR/ACR/Artifactory: set registry.enabled=false (default)
 # and provide SUPPLINE_REGISTRY_* (+ upstream creds) via values-secrets.yaml.
 # Those env vars are available in suppline.yml via {{ env "…" }}.
-# The bundled registry:2 is for labs / bootstrap only — do not treat it as a long-term prod registry.
+# The bundled registry:3 is for labs / bootstrap only — do not treat it as a long-term prod registry.
 registry:
   enabled: false
   
   # Image configuration
   image:
     repository: registry
-    tag: 2.8.3
+    tag: 3.1.1
     pullPolicy: IfNotPresent
   
   # Service configuration
diff --git a/docker-compose.yml b/docker-compose.yml
index c4b6607..cde092f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@
 # Docs: docs/EVAL.md
 services:
   registry:
-    image: registry:2.8.3
+    image: registry:3.1.1
     container_name: suppline-registry
     environment:
       - REGISTRY_STORAGE_DELETE_ENABLED=true
diff --git a/docs/EVAL.md b/docs/EVAL.md
index 044009b..d9c4a53 100644
--- a/docs/EVAL.md
+++ b/docs/EVAL.md
@@ -52,7 +52,7 @@ curl -s -H "Authorization: Bearer demo" http://localhost:8080/api/v1/scans | hea
 
 | Piece | Behavior |
 |-------|----------|
-| Registry | Bundled `registry:2` over HTTP — **not** for production |
+| Registry | Bundled `registry:3` over HTTP — **not** for production |
 | Sources | `public.ecr.aws` (no auth). Docker Hub is optional via `.env` |
 | Signing | Cosign keypair auto-generated into `./keys/demo` on first start (does not touch existing `./keys/cosign.*`) |
 | `demo-pass` / `demo-fail` | Intentional CEL `true` / `false` so pass+fail always show for the gate |
diff --git a/docs/REGISTRY.md b/docs/REGISTRY.md
index 9b205ab..22d4a14 100644
--- a/docs/REGISTRY.md
+++ b/docs/REGISTRY.md
@@ -1,6 +1,6 @@
 # Private Docker Registry (Helm)
 
-The Helm chart can optionally deploy a self-contained `registry:2` for lab/bootstrap use.
+The Helm chart can optionally deploy a self-contained `registry:3` for lab/bootstrap use.
 
 **Defaults**
 
diff --git a/test/integration/README.md b/test/integration/README.md
index a2d1d47..06ec693 100644
--- a/test/integration/README.md
+++ b/test/integration/README.md
@@ -103,7 +103,7 @@ The integration tests cover:
 ### Test Registry
 - **Port**: 5000
 - **Purpose**: Local Docker registry for testing image operations and attestations
-- **Image**: registry:2
+- **Image**: registry:3.1.1
 - **Startup time**: ~5 seconds
 - **Usage**: Tests automatically push images to `localhost:5000/test/*` for attestation testing