Yes. Build once, scan that exact image digest, and promote the same digest through test, staging and production. If you rebuild per environment, the thing in production was never the thing you tested or scanned, and your release evidence stops being trustworthy.
The problem with rebuilding
Some pipelines rebuild from source for each environment. Base images update, package mirrors change, and a build that passed on Monday can produce a different artifact on Thursday. Your scan result describes the Monday build. Production runs the Thursday one.
Tags versus digests
Kubernetes documentation explains the difference. It says tags can be moved to point to different images, while digests are hashes of the image content and are immutable. It adds that specifying an image by digest pins the code you run so that a change at the registry cannot lead to a mix of versions, and it advises avoiding the latest tag in production.
For release evidence, the digest is the right identifier. A scan report that names a tag proves little if the tag has moved.
What promote means in practice
- Build the image once in CI.
- Record its digest.
- Scan that digest, and store the result against it.
- Sign or otherwise protect the artifact record, if your process supports it.
- Deploy the digest to each environment in turn, with configuration supplied at deploy time rather than baked in.
- Block any deploy whose digest has no passing scan record.
| Approach | Scan covers what runs? | Evidence quality |
|---|---|---|
| Rebuild per environment | Not guaranteed | Weak |
| Promote by tag | Only if the tag never moves | Moderate |
| Promote by digest | Yes | Strong |
Handle new findings after the scan
Promotion by digest does not freeze the risk. A new advisory can make a scanned image vulnerable the next day. Re-scan stored digests on a schedule and on new advisories, and let the release record show both the release-time result and later results.
When you must rebuild
Sometimes a base image patch means a rebuild. Treat the result as a new artifact with a new digest, a new scan and a new release record, not an in-place update of the old one.
Try it yourself
Click through it at your own pace, or open it full screen.
Note how the findings are tied to one specific image rather than to a name.
Safeguard scans container images and dependencies, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Is a version tag good enough for evidence?
Only if tags are immutable in your registry. A digest is safer because it cannot change.
Do we scan again in production?
Yes, on a schedule. The artifact is the same, but the vulnerability data changes.
Sources
Last reviewed: 19 October 2026.
