diff --git a/packages/dashmate/configs/defaults/getBaseConfigFactory.js b/packages/dashmate/configs/defaults/getBaseConfigFactory.js
index 6aad7e7bd3b..e9eb9cf6aea 100644
--- a/packages/dashmate/configs/defaults/getBaseConfigFactory.js
+++ b/packages/dashmate/configs/defaults/getBaseConfigFactory.js
@@ -358,7 +358,7 @@ export default function getBaseConfigFactory() {
           tenderdash: {
             mode: 'full',
             docker: {
-              image: 'dashpay/tenderdash:1.6-dev.1',
+              image: 'dashpay/tenderdash:1.6.0',
             },
             p2p: {
               host: '0.0.0.0',
diff --git a/packages/dashmate/configs/getConfigFileMigrationsFactory.js b/packages/dashmate/configs/getConfigFileMigrationsFactory.js
index 90f5b770978..bde04e242c0 100644
--- a/packages/dashmate/configs/getConfigFileMigrationsFactory.js
+++ b/packages/dashmate/configs/getConfigFileMigrationsFactory.js
@@ -1523,6 +1523,13 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
       '4.0.0-rc.3': (configFile) => {
         Object.entries(configFile.configs)
           .forEach(([, options]) => {
+            // Bump the default Tenderdash image to the 1.6.0 line. Pulled DRY from
+            // the base config so it tracks whatever the base config pins.
+            // Keyed at the next release (4.0.0-rc.3), not the already-released
+            // rc.2: the runner skips fromVersion===toVersion, so a key equal to
+            // an operator's current version never fires.
+            options.platform.drive.tenderdash.docker.image = base.get('platform.drive.tenderdash.docker.image');
+
             // Add responseHeaders toggle to rate limiter (default true so existing
             // deployments keep emitting RateLimit-* headers; rs-dapi-client depends
             // on RateLimit-Reset to apply precise ban windows instead of the