Do: pair a readable image reference with the digest actually received. Example: retain approved.example/app@sha256:… beside the friendly repository tag used in a local test. Check: compare the recorded digest with local inspect output before running or promoting the image; if it differs, stop and review rather than silently accepting a moving tag.