diff --git a/.gitlab/generate-ci-images.php b/.gitlab/generate-ci-images.php
index ee9db882d3..42ed18bf55 100644
--- a/.gitlab/generate-ci-images.php
+++ b/.gitlab/generate-ci-images.php
@@ -157,7 +157,7 @@ function parse_compose(string $path, array $env): array
   # No deps: a publish just mirrors whatever already exists in
   # registry.ddbuild.io, so it can run without (re)building.
   needs: []
-  image: registry.ddbuild.io/agent-delivery/dd-pkg:v0.9.3
+  image: registry.ddbuild.io/agent-delivery/dd-pkg@sha256:316a4ad7eba06e7db4c2ddc490d7ee61bd10a95c6c89bbf97c41ceec4b003701
   tags: ["arch:arm64"]
   # $TAG is supplied per matrix entry by the generated publish jobs.
   variables: