diff --git a/CHANGELOG.md b/CHANGELOG.md
index b3b2189e..ec1afb9a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,32 @@
+## Release 2.0.3
+
+Bug fixes
+
+* Weave-npc would crash on a policy with no 'from' part - regression introduced in 2.0.2 #3095,#3096,#3097
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/61?closed=1).
+
+
+## Release 2.0.2
+
+Bug fixes and minor improvements
+
+* Fix race condition in weave-npc which would intermittently block all traffic for a namespace  #3057,#3059
+* Ensure Fast Datapath works on machines that need to mount the kernel module dynamically #3080
+* Regression: weave-npc would block everything if `kubelet --hostname-override` was used #3049,#3051
+* Fix netfilter rules to block containers from accessing the Weave Net control endpoint #3093
+* If DNS server is off then disable proxy DNS registration, to avoid spurious errors #3054,#3088
+* Add comments to each iptables rule and ipset, to help when troubleshooting #3064
+* Remove code that checked for an outdated fallback address for Kubernetes api-server #3071
+* Add a label to the weavedb image so it can be filtered out by tools #3066
+* Fix various build and continuous-integration failures #3061
+* Print 'help' text faster in the weave script #3056
+* Add an option to create continuous integration hosts in different ways  #3060
+* Remove remnants of the pre-2.0 proxy and plugin from build and test #3035,#3036
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/60?closed=1).
+
+
 ## Release 2.0.1
 
 Bug fixes and minor improvements
diff --git a/npc/rule.go b/npc/rule.go
index 5ed49129..fd695f98 100644
--- a/npc/rule.go
+++ b/npc/rule.go
@@ -20,23 +20,25 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds
 	if proto != nil {
 		args = append(args, "-p", *proto)
 	}
+	srcComment := "anywhere"
 	if srcHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(srcHost.ipsetName), "src")
+		if srcHost.nsName != "" {
+			srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key)
+		} else {
+			srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key)
+		}
 	}
+	dstComment := "anywhere"
 	if dstHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(dstHost.ipsetName), "dst")
+		dstComment = fmt.Sprintf("pods: namespace: %s, selector: %s", dstHost.nsName, dstHost.key)
 	}
 	if dstPort != nil {
 		args = append(args, "--dport", *dstPort)
 	}
 	args = append(args, "-j", "ACCEPT")
-	srcComment := ""
-	if srcHost.nsName != "" {
-		srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key)
-	} else {
-		srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key)
-	}
-	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> namespace: %s, key: %s", srcComment, dstHost.nsName, dstHost.key))
+	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment))
 	key := strings.Join(args, " ")
 
 	return &ruleSpec{key, args}
diff --git a/npc/rule_test.go b/npc/rule_test.go
new file mode 100644
index 00000000..dee1802f
--- /dev/null
+++ b/npc/rule_test.go
@@ -0,0 +1,16 @@
+package npc
+
+import (
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestRegressionHandleNil3095(t *testing.T) {
+	// Test for handling nil values
+	// https://github.com/weaveworks/weave/issues/3095
+
+	rs := newRuleSpec(nil, nil, nil, nil)
+
+	require.NotEqual(t, rs.key, "")
+
+}
diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh
index 9b98dec1..9718b556 100755
--- a/test/840_weave_kube_3_test.sh
+++ b/test/840_weave_kube_3_test.sh
@@ -94,6 +94,20 @@ spec:
       run: nettest
 EOF
 
+# Another policy, this time with no 'from' section, just to check that doesn't cause a crash
+run_on $HOST1 "$KUBECTL apply -f -" <<EOF
+apiVersion: extensions/v1beta1
+kind: NetworkPolicy
+metadata:
+  name: test840f
+spec:
+  ingress:
+  - {}
+  podSelector:
+    matchLabels:
+      run: norealpods
+EOF
+
 check_ready() {
     run_on $HOST1 "$KUBECTL get nodes | grep -c -w Ready | grep $NUM_HOSTS"
 }
@@ -135,6 +149,9 @@ assert_raises 'wait_for_x check_all_pods_communicate pods'
 # Check that a pod can contact the outside world
 assert_raises "$SSH $HOST1 $KUBECTL exec $podName -- $PING 8.8.8.8"
 
+# Check that our pods haven't crashed
+assert "$SSH $HOST1 $KUBECTL get pods -n kube-system -l name=weave-net | grep -c Running" 3
+
 tear_down_kubeadm
 
 # Destroy our test ipset, and implicitly check it is still there
diff --git a/test/run-integration-tests.sh b/test/run-integration-tests.sh
index 97c8e9d1..bd5afd01 100755
--- a/test/run-integration-tests.sh
+++ b/test/run-integration-tests.sh
@@ -26,6 +26,7 @@ NAME=${NAME:-"$(whoami | sed -e 's/[\.\_]*//g' | cut -c 1-4)"}
 PROVIDER=${PROVIDER:-gcp} # Provision using provided provider, or Google Cloud Platform by default.
 NUM_HOSTS=${NUM_HOSTS:-3}
 PLAYBOOK=${PLAYBOOK:-setup_weave-net_test.yml}
+PLAYBOOK_DOCKER_INSTALL_ROLE=${PLAYBOOK_DOCKER_INSTALL_ROLE:-docker-from-get.docker.com}
 TESTS=${TESTS:-}
 RUNNER_ARGS=${RUNNER_ARGS:-""}
 # Dependencies' versions:
@@ -269,7 +270,7 @@ function provision() {
 function configure_with_ansible() {
     ansible-playbook -u "$1" -i "$2" --private-key="$3" --forks="${4:-$NUM_HOSTS}" \
         --ssh-extra-args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
-        --extra-vars "docker_version=$DOCKER_VERSION kubernetes_version=$KUBERNETES_VERSION kubernetes_cni_version=$KUBERNETES_CNI_VERSION" \
+        --extra-vars "docker_version=$DOCKER_VERSION kubernetes_version=$KUBERNETES_VERSION kubernetes_cni_version=$KUBERNETES_CNI_VERSION docker_install_role=$PLAYBOOK_DOCKER_INSTALL_ROLE" \
         "$DIR/../tools/config_management/$PLAYBOOK"
 }