diff --git a/packages/testing/containers/services/sandbox.ts b/packages/testing/containers/services/sandbox.ts
index b5c599fce86..f4fe97299a1 100644
--- a/packages/testing/containers/services/sandbox.ts
+++ b/packages/testing/containers/services/sandbox.ts
@@ -258,7 +258,7 @@ export const sandbox: Service<SandboxResult> = {
 					SANDBOX_RUNNER_API_KEYS: RUNNER_API_KEY,
 					SANDBOX_RUNNER_REGISTRATION_TOKEN: REGISTRATION_TOKEN,
 					SANDBOX_RUNNER_API_GRPC_ADDR: `${API_HOSTNAME}:${API_GRPC_PORT}`,
-					SANDBOX_RUNNER_HTTP_BASE_URL: `http://${RUNNER_HOSTNAME}:${API_HTTP_PORT}`,
+					SANDBOX_RUNNER_HTTP_BASE_URL: `https://${RUNNER_HOSTNAME}:${API_HTTP_PORT}`,
 					SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ':9091',
 					SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: `${RUNNER_HOSTNAME}:9091`,
 					SANDBOX_RUNNER_ID: 'ci-runner-1',
@@ -274,8 +274,11 @@ export const sandbox: Service<SandboxResult> = {
 				})
 				.withExposedPorts(API_HTTP_PORT)
 				.withWaitStrategy(
+					// `/healthz` is the one route exempt from the client-certificate check.
+					// BusyBox wget cannot be given a CA file, so the probe skips verification:
+					// it answers "is the listener up", and the mTLS path is what the API uses.
 					Wait.forSuccessfulCommand(
-						`wget -q -O /dev/null --header='X-Api-Key: ${RUNNER_API_KEY}' http://localhost:${API_HTTP_PORT}/healthz`,
+						`wget -q -O /dev/null --no-check-certificate https://localhost:${API_HTTP_PORT}/healthz`,
 					).withStartupTimeout(120_000),
 				)
 				.withLogConsumer(runnerConsumer)
diff --git a/packages/testing/containers/test-containers.ts b/packages/testing/containers/test-containers.ts
index 14d5d66c05a..1e35a40eecc 100644
--- a/packages/testing/containers/test-containers.ts
+++ b/packages/testing/containers/test-containers.ts
@@ -45,11 +45,9 @@ const DEFAULT_IMAGES = {
 	localstack: 'localstack/localstack:4.13.1',
 	postgresExporter: 'prometheuscommunity/postgres-exporter:v0.17.1',
 	cadvisor: 'gcr.io/cadvisor/cadvisor:v0.49.1',
-	// Pinned: from 1.3.0 the runner rejects a non-https SANDBOX_RUNNER_HTTP_BASE_URL,
-	// which the local stack in services/sandbox.ts still sets.
-	sandboxApi: 'n8nio/n8n-sandbox-service-api:1.2.0',
-	sandboxRunner: 'n8nio/n8n-sandbox-service-runner-dind:1.2.0',
-	sandboxSandbox: 'n8nio/n8n-sandbox-service-sandbox:1.1.0',
+	sandboxApi: 'n8nio/n8n-sandbox-service-api:1.3.0',
+	sandboxRunner: 'n8nio/n8n-sandbox-service-runner-dind:1.3.0',
+	sandboxSandbox: 'n8nio/n8n-sandbox-service-sandbox:1.3.0',
 } as const;
 
 /** Convert camelCase to SCREAMING_SNAKE_CASE for env var names */