diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index cf533f2..1778b2a 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.0.1"
+  ".": "4.0.2"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d363f78..1cec30c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.2](https://github.com/GSA-TTS/agentic-coding-quickstart/compare/v4.0.1...v4.0.2) (2026-10-10)
+
+
+### Bug Fixes
+
+* **msb:** route ssh-agent forward through a managed symlink ([#564](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/564)) ([cd26a9f](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/cd26a9f3d47381c965c96bb1d23d75fa9152936b))
+
 ## [4.0.1](https://github.com/GSA-TTS/agentic-coding-quickstart/compare/v4.0.0...v4.0.1) (2026-10-06)
 
 ### Features
diff --git a/README.md b/README.md
index d4e3e54..a29c605 100644
--- a/README.md
+++ b/README.md
@@ -86,7 +86,7 @@ Run the one-line installer for your shell.
 <!-- x-release-please-start-version -->
 
 ```bash
-curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.1/install.sh | sh
+curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.2/install.sh | sh
 ```
 
 <!-- x-release-please-end -->
@@ -96,7 +96,7 @@ curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/downloa
 <!-- x-release-please-start-version -->
 
 ```powershell
-irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.1/install.ps1 | iex
+irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.2/install.ps1 | iex
 ```
 
 <!-- x-release-please-end -->
@@ -143,7 +143,7 @@ CLI (`gh`), you can also verify the release asset attestations before running
 anything:
 
 ```bash
-ACQ_VERSION=4.0.1 # x-release-please-version
+ACQ_VERSION=4.0.2 # x-release-please-version
 curl -fsSLO "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v${ACQ_VERSION}/install.sh"
 curl -fsSLO "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v${ACQ_VERSION}/SHA256SUMS"
 gh attestation verify install.sh --repo GSA-TTS/agentic-coding-quickstart
@@ -165,7 +165,7 @@ For Windows preview installs, download and inspect the PowerShell installer
 instead:
 
 ```powershell
-$AcqVersion = "4.0.1" # x-release-please-version
+$AcqVersion = "4.0.2" # x-release-please-version
 $BaseUrl = "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v$AcqVersion"
 Invoke-WebRequest "$BaseUrl/install.ps1" -OutFile install.ps1
 Get-Content .\install.ps1
diff --git a/docs/howto/acq.md b/docs/howto/acq.md
index a9707a2..d79c010 100644
--- a/docs/howto/acq.md
+++ b/docs/howto/acq.md
@@ -227,7 +227,7 @@ reboot the machine.
 <!-- x-release-please-start-version -->
 
 ```powershell
-irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.1/install.ps1 | iex
+irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.2/install.ps1 | iex
 ```
 
 <!-- x-release-please-end -->
@@ -235,7 +235,7 @@ irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.
 For an inspect-first install:
 
 ```powershell
-$AcqVersion = "4.0.1" # x-release-please-version
+$AcqVersion = "4.0.2" # x-release-please-version
 $BaseUrl = "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v$AcqVersion"
 Invoke-WebRequest "$BaseUrl/install.ps1" -OutFile install.ps1
 Get-Content .\install.ps1
diff --git a/install.ps1 b/install.ps1
index b15a897..693e1fa 100644
--- a/install.ps1
+++ b/install.ps1
@@ -6,7 +6,7 @@
 
 [CmdletBinding()]
 param(
-    [string]$Version = "4.0.1", # x-release-please-version
+    [string]$Version = "4.0.2", # x-release-please-version
     [string]$InstallDir = "",
     [string]$PackageUrl = "",
     [string]$Sha256 = "",
diff --git a/install.sh b/install.sh
index 4c9929e..5b3e12d 100644
--- a/install.sh
+++ b/install.sh
@@ -35,7 +35,7 @@ REPO_URL="${ACQ_INSTALL_REPO_URL:-https://github.com/GSA-TTS/agentic-coding-quic
 # release-please updates this version in release PRs. Release automation also
 # publishes an install.sh asset with DEFAULT_RELEASE_SHA replaced by the exact
 # release commit so clone installs can verify they landed on that commit.
-DEFAULT_RELEASE_VERSION="4.0.1" # x-release-please-version
+DEFAULT_RELEASE_VERSION="4.0.2" # x-release-please-version
 DEFAULT_RELEASE_REF="v$DEFAULT_RELEASE_VERSION"
 DEFAULT_RELEASE_SHA=""
 REF="${ACQ_INSTALL_REF:-$DEFAULT_RELEASE_REF}"
diff --git a/package.json b/package.json
index c55cfe5..e88d622 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@gsa-tts/agentic-coding-quickstart",
   "//version": "Managed by release-please via extra-files in release-please-config.json; do not edit by hand.",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "acq — run AI coding agents inside a federally-configured sandbox (SBX or MSB) with USAi endpoints",
   "type": "module",
   "bin": {