diff --git a/go/core/internal/controller/translator/agent/adk_api_translator.go b/go/core/internal/controller/translator/agent/adk_api_translator.go
index 548ea9c5b5..ffdbb39621 100644
--- a/go/core/internal/controller/translator/agent/adk_api_translator.go
+++ b/go/core/internal/controller/translator/agent/adk_api_translator.go
@@ -117,8 +117,12 @@ var DefaultImageConfig = ImageConfig{
 }
 
 // PythonADKImageDigest, PythonADKFullImageDigest, GoADKImageDigest, and GoADKFullImageDigest
-// are set at controller link time from the pushed runtime image manifest digests. The "full"
-// variants bundle the sandbox runtime (code execution / bash tools); the slim variants do not.
+// default to the pushed runtime image manifest digests baked in at controller link time, and
+// can be overridden at runtime via the --app[-full]-image-digest / --golang-adk[-full]-image-digest
+// flags (for mirrored registries that re-assign digests). They are only consulted for sandbox
+// agents — Substrate requires digest-pinned refs — while regular agents reference images by tag.
+// The "full" variants bundle the sandbox runtime (code execution / bash tools); the slim
+// variants do not.
 var PythonADKImageDigest string
 var PythonADKFullImageDigest string
 var GoADKImageDigest string
diff --git a/go/core/internal/controller/translator/agent/deployments.go b/go/core/internal/controller/translator/agent/deployments.go
index 794b7ab57c..588ecf9e57 100644
--- a/go/core/internal/controller/translator/agent/deployments.go
+++ b/go/core/internal/controller/translator/agent/deployments.go
@@ -123,7 +123,7 @@ func validateExtraContainers(containers []corev1.Container) error {
 	return nil
 }
 
-func resolvePythonRuntimeImage(registry string, full bool) (string, error) {
+func resolvePythonRuntimeImage(registry string, full, pinDigest bool) (string, error) {
 	repo := DefaultImageConfig.Repository
 	digest := PythonADKImageDigest
 	imageLabel := "app"
@@ -131,16 +131,10 @@ func resolvePythonRuntimeImage(registry string, full bool) (string, error) {
 		digest = PythonADKFullImageDigest
 		imageLabel = "app-full"
 	}
-	if d := normalizeImageDigest(digest); d != "" {
-		return fmt.Sprintf("%s/%s@%s", registry, repo, d), nil
-	}
-	return "", fmt.Errorf(
-		"%s image digest is not set at link time; rebuild the controller after pushing agent runtime images",
-		imageLabel,
-	)
+	return resolveRuntimeImage(registry, repo, digest, imageLabel, full, pinDigest)
 }
 
-func resolveGoRuntimeImage(registry string, full bool) (string, error) {
+func resolveGoRuntimeImage(registry string, full, pinDigest bool) (string, error) {
 	repo := getRuntimeImageRepository(v1alpha2.DeclarativeRuntime_Go)
 	digest := GoADKImageDigest
 	imageLabel := "golang-adk"
@@ -148,12 +142,34 @@ func resolveGoRuntimeImage(registry string, full bool) (string, error) {
 		digest = GoADKFullImageDigest
 		imageLabel = "golang-adk-full"
 	}
+	return resolveRuntimeImage(registry, repo, digest, imageLabel, full, pinDigest)
+}
+
+// resolveRuntimeImage builds the image reference for a declarative agent runtime.
+//
+// Regular agents get a tag reference (registry/repository:tag) so mirrored
+// registries that do not preserve upstream manifest digests still resolve
+// (https://github.com/kagent-dev/kagent/issues/2055). Full-variant images share
+// the repository and are published under "<tag>-full" (see APP_FULL_IMAGE_TAG /
+// GOLANG_ADK_FULL_IMAGE_TAG in the Makefile).
+//
+// Sandbox agents require pinDigest: Substrate ActorTemplate validation rejects
+// image refs without a digest, so those use the link-time (or flag-overridden)
+// runtime image digests.
+func resolveRuntimeImage(registry, repository, digest, imageLabel string, full, pinDigest bool) (string, error) {
+	if !pinDigest {
+		tag := DefaultImageConfig.Tag
+		if full {
+			tag += "-full"
+		}
+		return fmt.Sprintf("%s/%s:%s", registry, repository, tag), nil
+	}
 	if d := normalizeImageDigest(digest); d != "" {
-		return fmt.Sprintf("%s/%s@%s", registry, repo, d), nil
+		return fmt.Sprintf("%s/%s@%s", registry, repository, d), nil
 	}
 	return "", fmt.Errorf(
-		"%s image digest is not set at link time; rebuild the controller after pushing agent runtime images",
-		imageLabel,
+		"%s image digest is not set; rebuild the controller after pushing agent runtime images, or override it via --%s-image-digest",
+		imageLabel, imageLabel,
 	)
 }
 
@@ -190,16 +206,19 @@ func resolveInlineDeployment(agent v1alpha2.AgentObject, mdd *modelDeploymentDat
 
 	var image string
 	full := needsSRTSettings(agent, specRef.Sandbox)
+	// Substrate ActorTemplates reject tag refs, so sandbox agents pin by digest;
+	// everything else references by tag (resolvable in mirrored registries).
+	pinDigest := agent.GetWorkloadMode() == v1alpha2.WorkloadModeSandbox
 	switch runtime {
 	case v1alpha2.DeclarativeRuntime_Go:
 		var err error
-		image, err = resolveGoRuntimeImage(registry, full)
+		image, err = resolveGoRuntimeImage(registry, full, pinDigest)
 		if err != nil {
 			return nil, err
 		}
 	default:
 		var err error
-		image, err = resolvePythonRuntimeImage(registry, full)
+		image, err = resolvePythonRuntimeImage(registry, full, pinDigest)
 		if err != nil {
 			return nil, err
 		}
diff --git a/go/core/internal/controller/translator/agent/imageconfig_test.go b/go/core/internal/controller/translator/agent/imageconfig_test.go
index 2ed1da4611..b8d3f7aa28 100644
--- a/go/core/internal/controller/translator/agent/imageconfig_test.go
+++ b/go/core/internal/controller/translator/agent/imageconfig_test.go
@@ -4,6 +4,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+
+	"github.com/kagent-dev/kagent/go/api/v1alpha2"
 )
 
 func TestImageConfigImage(t *testing.T) {
@@ -45,11 +47,11 @@ func TestResolveGoRuntimeImageWithDigest(t *testing.T) {
 	GoADKImageDigest = "sha256:go-base"
 	GoADKFullImageDigest = "sha256:go-full"
 
-	got, err := resolveGoRuntimeImage("localhost:5001", false)
+	got, err := resolveGoRuntimeImage("localhost:5001", false, true)
 	require.NoError(t, err)
 	require.Equal(t, "localhost:5001/kagent-dev/kagent/golang-adk@sha256:go-base", got)
 
-	got, err = resolveGoRuntimeImage("localhost:5001", true)
+	got, err = resolveGoRuntimeImage("localhost:5001", true, true)
 	require.NoError(t, err)
 	require.Equal(t, "localhost:5001/kagent-dev/kagent/golang-adk@sha256:go-full", got)
 }
@@ -64,11 +66,11 @@ func TestResolveGoRuntimeImageWithoutDigest(t *testing.T) {
 	GoADKImageDigest = ""
 	GoADKFullImageDigest = ""
 
-	_, err := resolveGoRuntimeImage("localhost:5001", false)
+	_, err := resolveGoRuntimeImage("localhost:5001", false, true)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "golang-adk")
 
-	_, err = resolveGoRuntimeImage("localhost:5001", true)
+	_, err = resolveGoRuntimeImage("localhost:5001", true, true)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "golang-adk-full")
 }
@@ -83,11 +85,11 @@ func TestResolvePythonRuntimeImageWithDigest(t *testing.T) {
 	PythonADKImageDigest = "sha256:app-digest"
 	PythonADKFullImageDigest = "sha256:app-full-digest"
 
-	got, err := resolvePythonRuntimeImage("ghcr.io", false)
+	got, err := resolvePythonRuntimeImage("ghcr.io", false, true)
 	require.NoError(t, err)
 	require.Equal(t, "ghcr.io/kagent-dev/kagent/app@sha256:app-digest", got)
 
-	gotFull, err := resolvePythonRuntimeImage("ghcr.io", true)
+	gotFull, err := resolvePythonRuntimeImage("ghcr.io", true, true)
 	require.NoError(t, err)
 	require.Equal(t, "ghcr.io/kagent-dev/kagent/app@sha256:app-full-digest", gotFull)
 }
@@ -99,7 +101,7 @@ func TestResolvePythonFullRuntimeImageWithoutDigest(t *testing.T) {
 	})
 	PythonADKFullImageDigest = ""
 
-	_, err := resolvePythonRuntimeImage("ghcr.io", true)
+	_, err := resolvePythonRuntimeImage("ghcr.io", true, true)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "app-full")
 }
@@ -122,7 +124,60 @@ func TestResolvePythonRuntimeImageWithoutDigest(t *testing.T) {
 	})
 	PythonADKImageDigest = ""
 
-	_, err := resolvePythonRuntimeImage("ghcr.io", false)
+	_, err := resolvePythonRuntimeImage("ghcr.io", false, true)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "app")
 }
+
+func TestResolveRuntimeImageByTag(t *testing.T) {
+	originalTag := DefaultImageConfig.Tag
+	t.Cleanup(func() { DefaultImageConfig.Tag = originalTag })
+	DefaultImageConfig.Tag = "v9.9.9"
+
+	got, err := resolvePythonRuntimeImage("my-registry.example.com", false, false)
+	require.NoError(t, err)
+	require.Equal(t, "my-registry.example.com/kagent-dev/kagent/app:v9.9.9", got)
+
+	got, err = resolvePythonRuntimeImage("my-registry.example.com", true, false)
+	require.NoError(t, err)
+	require.Equal(t, "my-registry.example.com/kagent-dev/kagent/app:v9.9.9-full", got)
+
+	got, err = resolveGoRuntimeImage("my-registry.example.com", false, false)
+	require.NoError(t, err)
+	require.Equal(t, "my-registry.example.com/kagent-dev/kagent/golang-adk:v9.9.9", got)
+
+	got, err = resolveGoRuntimeImage("my-registry.example.com", true, false)
+	require.NoError(t, err)
+	require.Equal(t, "my-registry.example.com/kagent-dev/kagent/golang-adk:v9.9.9-full", got)
+}
+
+func TestResolveRuntimeImageByTagIgnoresMissingDigest(t *testing.T) {
+	original := PythonADKImageDigest
+	t.Cleanup(func() { PythonADKImageDigest = original })
+	PythonADKImageDigest = ""
+
+	_, err := resolvePythonRuntimeImage("ghcr.io", false, false)
+	require.NoError(t, err)
+}
+
+func TestResolveInlineDeploymentImagePinning(t *testing.T) {
+	original := PythonADKImageDigest
+	t.Cleanup(func() { PythonADKImageDigest = original })
+	PythonADKImageDigest = "sha256:pin-test"
+
+	spec := v1alpha2.AgentSpec{
+		Type:        v1alpha2.AgentType_Declarative,
+		Declarative: &v1alpha2.DeclarativeAgentSpec{SystemMessage: "test", ModelConfig: "test-model"},
+	}
+
+	regular := &v1alpha2.Agent{Spec: spec}
+	dep, err := resolveInlineDeployment(regular, &modelDeploymentData{})
+	require.NoError(t, err)
+	require.NotContains(t, dep.Image, "@sha256:", "regular agents reference images by tag")
+	require.Contains(t, dep.Image, ":"+DefaultImageConfig.Tag)
+
+	sandbox := &v1alpha2.SandboxAgent{Spec: v1alpha2.SandboxAgentSpec{AgentSpec: spec}}
+	sdep, err := resolveInlineDeployment(sandbox, &modelDeploymentData{})
+	require.NoError(t, err)
+	require.Contains(t, sdep.Image, "@sha256:pin-test", "sandbox agents require digest-pinned images (Substrate rejects tag refs)")
+}
diff --git a/go/core/internal/controller/translator/agent/runtime_test.go b/go/core/internal/controller/translator/agent/runtime_test.go
index f196415ed8..78bff6cd3d 100644
--- a/go/core/internal/controller/translator/agent/runtime_test.go
+++ b/go/core/internal/controller/translator/agent/runtime_test.go
@@ -105,7 +105,8 @@ func TestRuntime_GoRuntime(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "golang-adk", "Image should use golang-adk repository")
-	assert.Contains(t, container.Image, "@sha256:test-go-base", "Go runtime should use digest-pinned golang-adk image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Go runtime should reference the golang-adk image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 
 	// Verify Go runtime readiness probe timings (fast startup)
 	require.NotNil(t, container.ReadinessProbe)
@@ -178,7 +179,8 @@ func TestRuntime_GoRuntimeWithSkillsUsesFullImageTag(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "golang-adk", "Image should use golang-adk repository")
-	assert.Contains(t, container.Image, "@sha256:test-go-full", "Go runtime with skills should use digest-pinned golang-adk-full image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag+"-full", "Go runtime with skills should reference the golang-adk full image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 }
 
 func TestRuntime_PythonRuntime(t *testing.T) {
@@ -245,11 +247,12 @@ func TestRuntime_PythonRuntime(t *testing.T) {
 	}
 	require.NotNil(t, deployment, "Deployment should be in manifest")
 
-	// Verify container image uses digest-pinned app (Python ADK)
+	// Verify container image uses the tag-referenced app image (Python ADK)
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
-	assert.Contains(t, container.Image, "/app@", "Image should use app repository")
-	assert.Contains(t, container.Image, "@sha256:test-app", "Python runtime should use digest-pinned app image")
+	assert.Contains(t, container.Image, "/app:", "Image should use app repository")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Python runtime should reference the app image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 
 	// Verify Python runtime readiness probe timings (slower startup)
 	require.NotNil(t, container.ReadinessProbe)
@@ -322,11 +325,12 @@ func TestRuntime_DefaultToPython(t *testing.T) {
 	}
 	require.NotNil(t, deployment, "Deployment should be in manifest")
 
-	// Verify container image uses digest-pinned app (Python ADK) by default
+	// Verify container image uses the tag-referenced app image (Python ADK) by default
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
-	assert.Contains(t, container.Image, "/app@", "Image should default to app repository")
-	assert.Contains(t, container.Image, "@sha256:test-app", "Default Python runtime should use digest-pinned app image")
+	assert.Contains(t, container.Image, "/app:", "Image should default to app repository")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Default Python runtime should reference the app image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 
 	// Verify Python runtime readiness probe timings
 	require.NotNil(t, container.ReadinessProbe)
@@ -412,7 +416,8 @@ func TestRuntime_CustomRepositoryPath(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "my-registry.com/custom/golang-adk", "Image should use custom repository with golang-adk")
-	assert.Contains(t, container.Image, "@sha256:test-go-base", "Go runtime should use digest-pinned golang-adk image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Go runtime should reference the golang-adk image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 }
 
 func TestRuntime_CustomRepositoryPath_WithSkillsUsesFullTag(t *testing.T) {
@@ -485,5 +490,6 @@ func TestRuntime_CustomRepositoryPath_WithSkillsUsesFullTag(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "my-registry.com/custom/golang-adk", "Image should use custom repository with golang-adk")
-	assert.Contains(t, container.Image, "@sha256:test-go-full", "Go runtime with skills should use digest-pinned golang-adk-full image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag+"-full", "Go runtime with skills should reference the golang-adk full image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 }
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json
index 96c95931df..55de744793 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json
@@ -186,7 +186,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json
index e0c771f433..2d4778ab49 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json
@@ -196,7 +196,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json
index fb14cf802f..18f95dc9c5 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json
@@ -193,7 +193,7 @@
                     "value": "/config/srt-settings.json"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app-full",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev-full",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json
index 3de966acce..50ad2fb363 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json
@@ -207,7 +207,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json
index d08cbd440d..d1b1089ea4 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json
@@ -202,7 +202,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json
index f602b91bac..118d630010 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json
@@ -155,7 +155,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json
index ef6e641acc..c4827d5bd7 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json
@@ -155,7 +155,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json
index 2a7d6fe548..c70478b36a 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json
@@ -202,7 +202,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json
index 87a820f108..67d7706ea4 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json
@@ -180,7 +180,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json
index de408d1ae6..3b5f620494 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json
@@ -215,7 +215,7 @@
                     "value": "/config/srt-settings.json"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app-full",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev-full",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json
index c9456d7884..416f187be3 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json
@@ -195,7 +195,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json
index c535e632a0..e0ae81e35b 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json
@@ -191,7 +191,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json
index ce0f571014..d9158ad17c 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json
@@ -191,7 +191,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json
index 79aa9d719e..7068685bf1 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json
@@ -189,7 +189,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json
index 3532fbe7e6..b5810b6161 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json
@@ -173,7 +173,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json
index ef6c3e9d68..112c806afa 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json
@@ -193,7 +193,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json
index 02a3f021d2..6e6ca083c4 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json
@@ -202,7 +202,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json
index 2488a5bdd4..7497960fc3 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json
@@ -191,7 +191,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json
index 9350dbf21c..cb635cd25e 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json
@@ -194,7 +194,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json
index 54d1bd3708..515396315c 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json
@@ -194,7 +194,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json
index 513201c414..ead7d57df4 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json
@@ -193,7 +193,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json
index 2728059968..3bf6e76e55 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json
@@ -197,7 +197,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json
index 06b6fef917..5a36a40f26 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json
@@ -206,7 +206,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json
index 0a63ed0fad..e485f338a9 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json
@@ -187,7 +187,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json
index c66e3d15ad..2495c8cf60 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json
@@ -215,7 +215,7 @@
                     "value": "/config/srt-settings.json"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app-full",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev-full",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json
index 75b39d8e18..a3ad31fd86 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json
@@ -187,7 +187,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json
index 759a7b7bfa..4b6b628ed8 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json
@@ -180,7 +180,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json
index 1bb92be837..1b8ab3d4b7 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json
@@ -180,7 +180,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json
index 079747fdc0..26fa3d7269 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json
@@ -183,7 +183,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json
index 78708815db..c24c0dcd9b 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json
@@ -187,7 +187,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json
index cff6d108d7..582ae31ec5 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json
@@ -193,7 +193,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json
index 90e13c6fcf..8e5e841d85 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json
@@ -182,7 +182,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json
index 11b9f8cfaf..3bb6b4a5b1 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json
@@ -185,7 +185,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json
index 80efc74645..c465f7f5a0 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json
@@ -184,7 +184,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json
index 5efaaeca02..b521151417 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json
@@ -185,7 +185,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "ghcr.io/kagent-dev/kagent/app@sha256:test-app",
+                "image": "ghcr.io/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/pkg/app/app.go b/go/core/pkg/app/app.go
index 9284436983..7516e36044 100644
--- a/go/core/pkg/app/app.go
+++ b/go/core/pkg/app/app.go
@@ -199,6 +199,10 @@ func (cfg *Config) SetFlags(commandLine *flag.FlagSet) {
 	commandLine.StringVar(&agent_translator.DefaultImageConfig.PullPolicy, "image-pull-policy", agent_translator.DefaultImageConfig.PullPolicy, "The pull policy to use for the image.")
 	commandLine.StringVar(&agent_translator.DefaultImageConfig.PullSecret, "image-pull-secret", "", "The pull secret name for the agent image.")
 	commandLine.StringVar(&agent_translator.DefaultImageConfig.Repository, "image-repository", agent_translator.DefaultImageConfig.Repository, "The repository to use for the agent image.")
+	commandLine.StringVar(&agent_translator.PythonADKImageDigest, "app-image-digest", agent_translator.PythonADKImageDigest, "Manifest digest (sha256:...) for the Python agent runtime image used by sandbox agents. Defaults to the digest baked in at build time; override when a mirrored registry re-assigns digests.")
+	commandLine.StringVar(&agent_translator.PythonADKFullImageDigest, "app-full-image-digest", agent_translator.PythonADKFullImageDigest, "Manifest digest (sha256:...) for the full Python agent runtime image used by sandbox agents. Defaults to the digest baked in at build time; override when a mirrored registry re-assigns digests.")
+	commandLine.StringVar(&agent_translator.GoADKImageDigest, "golang-adk-image-digest", agent_translator.GoADKImageDigest, "Manifest digest (sha256:...) for the Go agent runtime image used by sandbox agents. Defaults to the digest baked in at build time; override when a mirrored registry re-assigns digests.")
+	commandLine.StringVar(&agent_translator.GoADKFullImageDigest, "golang-adk-full-image-digest", agent_translator.GoADKFullImageDigest, "Manifest digest (sha256:...) for the full Go agent runtime image used by sandbox agents. Defaults to the digest baked in at build time; override when a mirrored registry re-assigns digests.")
 	commandLine.StringVar(&agent_translator.DefaultSkillsInitImageConfig.Registry, "skills-init-image-registry", agent_translator.DefaultSkillsInitImageConfig.Registry, "The registry to use for the skills init image.")
 	commandLine.StringVar(&agent_translator.DefaultSkillsInitImageConfig.Tag, "skills-init-image-tag", agent_translator.DefaultSkillsInitImageConfig.Tag, "The tag to use for the skills init image.")
 	commandLine.StringVar(&agent_translator.DefaultSkillsInitImageConfig.PullPolicy, "skills-init-image-pull-policy", agent_translator.DefaultSkillsInitImageConfig.PullPolicy, "The pull policy to use for the skills init image.")