diff --git a/.env.example b/.env.example
index bf52801..32b235a 100644
--- a/.env.example
+++ b/.env.example
@@ -5,13 +5,13 @@ DATABASE_URL=postgres://wrenn:wrenn@localhost:5432/wrenn?sslmode=disable
 REDIS_URL=redis://localhost:6379/0
 
 # Control Plane
-CP_LISTEN_ADDR=:8080
+WRENN_CP_LISTEN_ADDR=:8080
 
 # Host Agent
-AGENT_LISTEN_ADDR=:50051
-AGENT_FILES_ROOTDIR=/var/lib/wrenn
-AGENT_HOST_INTERFACE=eth0
-AGENT_CP_URL=http://localhost:8080
+WRENN_HOST_LISTEN_ADDR=:50051
+WRENN_DIR=/var/lib/wrenn
+WRENN_HOST_INTERFACE=eth0
+WRENN_CP_URL=http://localhost:8080
 
 # Lago (billing — external service)
 LAGO_API_URL=http://localhost:3000
diff --git a/README.md b/README.md
index dff1932..e2b290f 100644
--- a/README.md
+++ b/README.md
@@ -51,12 +51,12 @@ Copy `.env.example` to `.env` and edit:
 DATABASE_URL=postgres://wrenn:wrenn@localhost:5432/wrenn?sslmode=disable
 
 # Control plane
-CP_LISTEN_ADDR=:8000
+WRENN_CP_LISTEN_ADDR=:8000
 CP_HOST_AGENT_ADDR=http://localhost:50051
 
 # Host agent
-AGENT_LISTEN_ADDR=:50051
-AGENT_FILES_ROOTDIR=/var/lib/wrenn
+WRENN_HOST_LISTEN_ADDR=:50051
+WRENN_DIR=/var/lib/wrenn
 ```
 
 ### Run
@@ -69,7 +69,7 @@ make migrate-up
 ./builds/wrenn-cp
 ```
 
-Control plane listens on `CP_LISTEN_ADDR` (default `:8000`).
+Control plane listens on `WRENN_CP_LISTEN_ADDR` (default `:8000`).
 
 ### Host registration
 
@@ -87,16 +87,16 @@ Hosts must be registered with the control plane before they can serve sandboxes.
 
 2. **Start the host agent** with the registration token and its externally-reachable address:
    ```bash
-   sudo AGENT_CP_URL=http://cp-host:8000 \
+   sudo WRENN_CP_URL=http://cp-host:8000 \
         ./builds/wrenn-agent \
         --register <token-from-step-1> \
         --address 10.0.1.5:50051
    ```
-   On first startup the agent sends its specs (arch, CPU, memory, disk) to the control plane, receives a long-lived host JWT, and saves it to `$AGENT_FILES_ROOTDIR/host-token`.
+   On first startup the agent sends its specs (arch, CPU, memory, disk) to the control plane, receives a long-lived host JWT, and saves it to `$WRENN_DIR/host-token`.
 
 3. **Subsequent startups** don't need `--register` — the agent loads the saved JWT automatically:
    ```bash
-   sudo AGENT_CP_URL=http://cp-host:8000 \
+   sudo WRENN_CP_URL=http://cp-host:8000 \
         ./builds/wrenn-agent --address 10.0.1.5:50051
    ```
 
@@ -107,7 +107,7 @@ Hosts must be registered with the control plane before they can serve sandboxes.
    ```
    Then restart the agent with the new token.
 
-The agent sends heartbeats to the control plane every 30 seconds. Host agent listens on `AGENT_LISTEN_ADDR` (default `:50051`).
+The agent sends heartbeats to the control plane every 30 seconds. Host agent listens on `WRENN_HOST_LISTEN_ADDR` (default `:50051`).
 
 ### Rootfs images
 
diff --git a/cmd/host-agent/main.go b/cmd/host-agent/main.go
index 76dc239..6665ba9 100644
--- a/cmd/host-agent/main.go
+++ b/cmd/host-agent/main.go
@@ -45,13 +45,13 @@ func main() {
 	// Clean up any stale dm-snapshot devices from a previous crash.
 	devicemapper.CleanupStaleDevices()
 
-	listenAddr := envOrDefault("AGENT_LISTEN_ADDR", ":50051")
-	rootDir := envOrDefault("AGENT_FILES_ROOTDIR", "/var/lib/wrenn")
-	cpURL := os.Getenv("AGENT_CP_URL")
+	listenAddr := envOrDefault("WRENN_HOST_LISTEN_ADDR", ":50051")
+	rootDir := envOrDefault("WRENN_DIR", "/var/lib/wrenn")
+	cpURL := os.Getenv("WRENN_CP_URL")
 	tokenFile := filepath.Join(rootDir, "host.jwt")
 
 	if cpURL == "" {
-		slog.Error("AGENT_CP_URL environment variable is required")
+		slog.Error("WRENN_CP_URL environment variable is required")
 		os.Exit(1)
 	}
 	if *advertiseAddr == "" {
@@ -61,17 +61,13 @@ func main() {
 
 	// Expand base images to the standard disk size (sparse, no extra physical
 	// disk). This ensures dm-snapshot sandboxes see the full size from boot.
-	imagesDir := filepath.Join(rootDir, "images")
-	if err := sandbox.EnsureImageSizes(imagesDir, sandbox.DefaultDiskSizeMB); err != nil {
+	if err := sandbox.EnsureImageSizes(rootDir, sandbox.DefaultDiskSizeMB); err != nil {
 		slog.Error("failed to expand base images", "error", err)
 		os.Exit(1)
 	}
 
 	cfg := sandbox.Config{
-		KernelPath:   filepath.Join(rootDir, "kernels", "vmlinux"),
-		ImagesDir:    filepath.Join(rootDir, "images"),
-		SandboxesDir: filepath.Join(rootDir, "sandboxes"),
-		SnapshotsDir: filepath.Join(rootDir, "snapshots"),
+		WrennDir: rootDir,
 	}
 
 	mgr := sandbox.New(cfg)
diff --git a/internal/config/config.go b/internal/config/config.go
index 7ef0aa6..a4564aa 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -28,7 +28,7 @@ func Load() Config {
 	return Config{
 		DatabaseURL: envOrDefault("DATABASE_URL", "postgres://wrenn:wrenn@localhost:5432/wrenn?sslmode=disable"),
 		RedisURL:    envOrDefault("REDIS_URL", "redis://localhost:6379/0"),
-		ListenAddr:  envOrDefault("CP_LISTEN_ADDR", ":8080"),
+		ListenAddr:  envOrDefault("WRENN_CP_LISTEN_ADDR", ":8080"),
 		JWTSecret:   os.Getenv("JWT_SECRET"),
 
 		OAuthGitHubClientID:     os.Getenv("OAUTH_GITHUB_CLIENT_ID"),
diff --git a/internal/hostagent/registration.go b/internal/hostagent/registration.go
index 9f39c3b..5948e0c 100644
--- a/internal/hostagent/registration.go
+++ b/internal/hostagent/registration.go
@@ -17,7 +17,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// tokenFile is the JSON format persisted to AGENT_FILES_ROOTDIR/host.jwt.
+// tokenFile is the JSON format persisted to WRENN_DIR/host.jwt.
 type tokenFile struct {
 	HostID       string `json:"host_id"`
 	JWT          string `json:"jwt"`
diff --git a/scripts/rootfs-from-container.sh b/scripts/rootfs-from-container.sh
index 2159ac7..2f96a3a 100755
--- a/scripts/rootfs-from-container.sh
+++ b/scripts/rootfs-from-container.sh
@@ -16,7 +16,7 @@
 #   image_name  — Directory name under images dir (e.g. "waitlist")
 #
 # Output:
-#   ${AGENT_FILES_ROOTDIR}/images/<image_name>/rootfs.ext4
+#   ${WRENN_DIR}/images/<image_name>/rootfs.ext4
 #
 # Requires: docker, mkfs.ext4, resize2fs, e2fsck, make (for building envd), curl (for tini download)
 # Sudo is used only for mount/umount/copy-into-image operations.
@@ -25,8 +25,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-AGENT_FILES_ROOTDIR="${AGENT_FILES_ROOTDIR:-/var/lib/wrenn}"
-AGENT_IMAGES_PATH="${AGENT_FILES_ROOTDIR}/images"
+WRENN_DIR="${WRENN_DIR:-/var/lib/wrenn}"
+WRENN_IMAGES_PATH="${WRENN_DIR}/images"
 
 if [ $# -lt 2 ]; then
     echo "Usage: $0 <container> <image_name>"
@@ -35,7 +35,7 @@ fi
 
 CONTAINER="$1"
 IMAGE_NAME="$2"
-OUTPUT_DIR="${AGENT_IMAGES_PATH}/${IMAGE_NAME}"
+OUTPUT_DIR="${WRENN_IMAGES_PATH}/${IMAGE_NAME}"
 OUTPUT_FILE="${OUTPUT_DIR}/rootfs.ext4"
 MOUNT_DIR="/tmp/wrenn-rootfs-build"
 TAR_FILE="/tmp/wrenn-rootfs-export-${IMAGE_NAME}.tar"