diff --git a/go/core/internal/controller/translator/agent/adk_api_translator.go b/go/core/internal/controller/translator/agent/adk_api_translator.go
index 4b09d30a2..410d133ee 100644
--- a/go/core/internal/controller/translator/agent/adk_api_translator.go
+++ b/go/core/internal/controller/translator/agent/adk_api_translator.go
@@ -116,8 +116,11 @@ var DefaultImageConfig = ImageConfig{
 	Repository: "kagent-dev/kagent/app",
 }
 
-// PythonADKImageDigest, GoADKImageDigest, and GoADKFullImageDigest are set at
-// controller link time from the pushed runtime image manifest digests.
+// PythonADKImageDigest, GoADKImageDigest, and GoADKFullImageDigest default to the pushed
+// runtime image manifest digests baked in at controller link time, and can be overridden at
+// runtime via the --app-image-digest / --golang-adk[-full]-image-digest flags (for mirrored
+// registries that re-assign digests). They are only consulted for sandbox agents — Substrate
+// requires digest-pinned refs — while regular agents reference images by tag.
 var PythonADKImageDigest string
 var GoADKImageDigest string
 var GoADKFullImageDigest string
diff --git a/go/core/internal/controller/translator/agent/deployments.go b/go/core/internal/controller/translator/agent/deployments.go
index 2a5525569..4b86507eb 100644
--- a/go/core/internal/controller/translator/agent/deployments.go
+++ b/go/core/internal/controller/translator/agent/deployments.go
@@ -123,17 +123,12 @@ func validateExtraContainers(containers []corev1.Container) error {
 	return nil
 }
 
-func resolvePythonRuntimeImage(registry string) (string, error) {
+func resolvePythonRuntimeImage(registry string, pinDigest bool) (string, error) {
 	repo := DefaultImageConfig.Repository
-	if d := normalizeImageDigest(PythonADKImageDigest); d != "" {
-		return fmt.Sprintf("%s/%s@%s", registry, repo, d), nil
-	}
-	return "", fmt.Errorf(
-		"app image digest is not set at link time; rebuild the controller after pushing agent runtime images",
-	)
+	return resolveRuntimeImage(registry, repo, PythonADKImageDigest, "app", false, pinDigest)
 }
 
-func resolveGoRuntimeImage(registry string, full bool) (string, error) {
+func resolveGoRuntimeImage(registry string, full, pinDigest bool) (string, error) {
 	repo := getRuntimeImageRepository(v1alpha2.DeclarativeRuntime_Go)
 	digest := GoADKImageDigest
 	imageLabel := "golang-adk"
@@ -141,12 +136,34 @@ func resolveGoRuntimeImage(registry string, full bool) (string, error) {
 		digest = GoADKFullImageDigest
 		imageLabel = "golang-adk-full"
 	}
+	return resolveRuntimeImage(registry, repo, digest, imageLabel, full, pinDigest)
+}
+
+// resolveRuntimeImage builds the image reference for a declarative agent runtime.
+//
+// Regular agents get a tag reference (registry/repository:tag) so mirrored
+// registries that do not preserve upstream manifest digests still resolve
+// (https://github.com/kagent-dev/kagent/issues/2055). Full-variant images share
+// the repository and are published under "<tag>-full" (see
+// GOLANG_ADK_FULL_IMAGE_TAG in the Makefile).
+//
+// Sandbox agents require pinDigest: Substrate ActorTemplate validation rejects
+// image refs without a digest, so those use the link-time (or flag-overridden)
+// runtime image digests.
+func resolveRuntimeImage(registry, repository, digest, imageLabel string, full, pinDigest bool) (string, error) {
+	if !pinDigest {
+		tag := DefaultImageConfig.Tag
+		if full {
+			tag += "-full"
+		}
+		return fmt.Sprintf("%s/%s:%s", registry, repository, tag), nil
+	}
 	if d := normalizeImageDigest(digest); d != "" {
-		return fmt.Sprintf("%s/%s@%s", registry, repo, d), nil
+		return fmt.Sprintf("%s/%s@%s", registry, repository, d), nil
 	}
 	return "", fmt.Errorf(
-		"%s image digest is not set at link time; rebuild the controller after pushing agent runtime images",
-		imageLabel,
+		"%s image digest is not set; rebuild the controller after pushing agent runtime images, or override it via --%s-image-digest",
+		imageLabel, imageLabel,
 	)
 }
 
@@ -183,16 +200,20 @@ func resolveInlineDeployment(agent v1alpha2.AgentObject, mdd *modelDeploymentDat
 
 	var image string
 	full := runtime == v1alpha2.DeclarativeRuntime_Go && needsSRTSettings(agent, specRef.Sandbox)
+	// Substrate ActorTemplates reject tag refs, so substrate sandbox agents pin by
+	// digest; everything else (including agent-sandbox platform sandbox agents)
+	// references by tag (resolvable in mirrored registries).
+	pinDigest := v1alpha2.AgentSandboxPlatform(agent) == v1alpha2.SandboxPlatformSubstrate
 	switch runtime {
 	case v1alpha2.DeclarativeRuntime_Go:
 		var err error
-		image, err = resolveGoRuntimeImage(registry, full)
+		image, err = resolveGoRuntimeImage(registry, full, pinDigest)
 		if err != nil {
 			return nil, err
 		}
 	default:
 		var err error
-		image, err = resolvePythonRuntimeImage(registry)
+		image, err = resolvePythonRuntimeImage(registry, pinDigest)
 		if err != nil {
 			return nil, err
 		}
diff --git a/go/core/internal/controller/translator/agent/imageconfig_test.go b/go/core/internal/controller/translator/agent/imageconfig_test.go
index be1870dcf..3b9e70bec 100644
--- a/go/core/internal/controller/translator/agent/imageconfig_test.go
+++ b/go/core/internal/controller/translator/agent/imageconfig_test.go
@@ -4,6 +4,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+
+	"github.com/kagent-dev/kagent/go/api/v1alpha2"
 )
 
 func TestImageConfigImage(t *testing.T) {
@@ -45,11 +47,11 @@ func TestResolveGoRuntimeImageWithDigest(t *testing.T) {
 	GoADKImageDigest = "sha256:go-base"
 	GoADKFullImageDigest = "sha256:go-full"
 
-	got, err := resolveGoRuntimeImage("localhost:5001", false)
+	got, err := resolveGoRuntimeImage("localhost:5001", false, true)
 	require.NoError(t, err)
 	require.Equal(t, "localhost:5001/kagent-dev/kagent/golang-adk@sha256:go-base", got)
 
-	got, err = resolveGoRuntimeImage("localhost:5001", true)
+	got, err = resolveGoRuntimeImage("localhost:5001", true, true)
 	require.NoError(t, err)
 	require.Equal(t, "localhost:5001/kagent-dev/kagent/golang-adk@sha256:go-full", got)
 }
@@ -64,11 +66,11 @@ func TestResolveGoRuntimeImageWithoutDigest(t *testing.T) {
 	GoADKImageDigest = ""
 	GoADKFullImageDigest = ""
 
-	_, err := resolveGoRuntimeImage("localhost:5001", false)
+	_, err := resolveGoRuntimeImage("localhost:5001", false, true)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "golang-adk")
 
-	_, err = resolveGoRuntimeImage("localhost:5001", true)
+	_, err = resolveGoRuntimeImage("localhost:5001", true, true)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "golang-adk-full")
 }
@@ -80,7 +82,7 @@ func TestResolvePythonRuntimeImageWithDigest(t *testing.T) {
 	})
 	PythonADKImageDigest = "sha256:app-digest"
 
-	got, err := resolvePythonRuntimeImage("cr.kagent.dev")
+	got, err := resolvePythonRuntimeImage("cr.kagent.dev", true)
 	require.NoError(t, err)
 	require.Equal(t, "cr.kagent.dev/kagent-dev/kagent/app@sha256:app-digest", got)
 }
@@ -103,7 +105,67 @@ func TestResolvePythonRuntimeImageWithoutDigest(t *testing.T) {
 	})
 	PythonADKImageDigest = ""
 
-	_, err := resolvePythonRuntimeImage("cr.kagent.dev")
+	_, err := resolvePythonRuntimeImage("cr.kagent.dev", true)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "app")
 }
+
+func TestResolveRuntimeImageByTag(t *testing.T) {
+	originalTag := DefaultImageConfig.Tag
+	t.Cleanup(func() { DefaultImageConfig.Tag = originalTag })
+	DefaultImageConfig.Tag = "v9.9.9"
+
+	got, err := resolvePythonRuntimeImage("my-registry.example.com", false)
+	require.NoError(t, err)
+	require.Equal(t, "my-registry.example.com/kagent-dev/kagent/app:v9.9.9", got)
+
+	got, err = resolveGoRuntimeImage("my-registry.example.com", false, false)
+	require.NoError(t, err)
+	require.Equal(t, "my-registry.example.com/kagent-dev/kagent/golang-adk:v9.9.9", got)
+
+	got, err = resolveGoRuntimeImage("my-registry.example.com", true, false)
+	require.NoError(t, err)
+	require.Equal(t, "my-registry.example.com/kagent-dev/kagent/golang-adk:v9.9.9-full", got)
+}
+
+func TestResolveRuntimeImageByTagIgnoresMissingDigest(t *testing.T) {
+	original := PythonADKImageDigest
+	t.Cleanup(func() { PythonADKImageDigest = original })
+	PythonADKImageDigest = ""
+
+	_, err := resolvePythonRuntimeImage("cr.kagent.dev", false)
+	require.NoError(t, err)
+}
+
+func TestResolveInlineDeploymentImagePinning(t *testing.T) {
+	original := PythonADKImageDigest
+	originalGo := GoADKImageDigest
+	t.Cleanup(func() {
+		PythonADKImageDigest = original
+		GoADKImageDigest = originalGo
+	})
+	PythonADKImageDigest = "sha256:pin-test"
+	GoADKImageDigest = "sha256:pin-test-go"
+
+	spec := v1alpha2.AgentSpec{
+		Type:        v1alpha2.AgentType_Declarative,
+		Declarative: &v1alpha2.DeclarativeAgentSpec{SystemMessage: "test", ModelConfig: "test-model"},
+	}
+
+	regular := &v1alpha2.Agent{Spec: spec}
+	dep, err := resolveInlineDeployment(regular, &modelDeploymentData{})
+	require.NoError(t, err)
+	require.NotContains(t, dep.Image, "@sha256:", "regular agents reference images by tag")
+	require.Contains(t, dep.Image, ":"+DefaultImageConfig.Tag)
+
+	agentSandbox := &v1alpha2.SandboxAgent{Spec: v1alpha2.SandboxAgentSpec{AgentSpec: spec}}
+	adep, err := resolveInlineDeployment(agentSandbox, &modelDeploymentData{})
+	require.NoError(t, err)
+	require.NotContains(t, adep.Image, "@sha256:", "agent-sandbox platform sandbox agents reference images by tag")
+	require.Contains(t, adep.Image, ":"+DefaultImageConfig.Tag)
+
+	substrate := &v1alpha2.SandboxAgent{Spec: v1alpha2.SandboxAgentSpec{AgentSpec: spec, Platform: v1alpha2.SandboxPlatformSubstrate}}
+	sdep, err := resolveInlineDeployment(substrate, &modelDeploymentData{})
+	require.NoError(t, err)
+	require.Contains(t, sdep.Image, "@sha256:pin-test-go", "substrate sandbox agents require digest-pinned images (Substrate rejects tag refs)")
+}
diff --git a/go/core/internal/controller/translator/agent/runtime_test.go b/go/core/internal/controller/translator/agent/runtime_test.go
index f196415ed..78bff6cd3 100644
--- a/go/core/internal/controller/translator/agent/runtime_test.go
+++ b/go/core/internal/controller/translator/agent/runtime_test.go
@@ -105,7 +105,8 @@ func TestRuntime_GoRuntime(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "golang-adk", "Image should use golang-adk repository")
-	assert.Contains(t, container.Image, "@sha256:test-go-base", "Go runtime should use digest-pinned golang-adk image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Go runtime should reference the golang-adk image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 
 	// Verify Go runtime readiness probe timings (fast startup)
 	require.NotNil(t, container.ReadinessProbe)
@@ -178,7 +179,8 @@ func TestRuntime_GoRuntimeWithSkillsUsesFullImageTag(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "golang-adk", "Image should use golang-adk repository")
-	assert.Contains(t, container.Image, "@sha256:test-go-full", "Go runtime with skills should use digest-pinned golang-adk-full image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag+"-full", "Go runtime with skills should reference the golang-adk full image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 }
 
 func TestRuntime_PythonRuntime(t *testing.T) {
@@ -245,11 +247,12 @@ func TestRuntime_PythonRuntime(t *testing.T) {
 	}
 	require.NotNil(t, deployment, "Deployment should be in manifest")
 
-	// Verify container image uses digest-pinned app (Python ADK)
+	// Verify container image uses the tag-referenced app image (Python ADK)
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
-	assert.Contains(t, container.Image, "/app@", "Image should use app repository")
-	assert.Contains(t, container.Image, "@sha256:test-app", "Python runtime should use digest-pinned app image")
+	assert.Contains(t, container.Image, "/app:", "Image should use app repository")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Python runtime should reference the app image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 
 	// Verify Python runtime readiness probe timings (slower startup)
 	require.NotNil(t, container.ReadinessProbe)
@@ -322,11 +325,12 @@ func TestRuntime_DefaultToPython(t *testing.T) {
 	}
 	require.NotNil(t, deployment, "Deployment should be in manifest")
 
-	// Verify container image uses digest-pinned app (Python ADK) by default
+	// Verify container image uses the tag-referenced app image (Python ADK) by default
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
-	assert.Contains(t, container.Image, "/app@", "Image should default to app repository")
-	assert.Contains(t, container.Image, "@sha256:test-app", "Default Python runtime should use digest-pinned app image")
+	assert.Contains(t, container.Image, "/app:", "Image should default to app repository")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Default Python runtime should reference the app image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 
 	// Verify Python runtime readiness probe timings
 	require.NotNil(t, container.ReadinessProbe)
@@ -412,7 +416,8 @@ func TestRuntime_CustomRepositoryPath(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "my-registry.com/custom/golang-adk", "Image should use custom repository with golang-adk")
-	assert.Contains(t, container.Image, "@sha256:test-go-base", "Go runtime should use digest-pinned golang-adk image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag, "Go runtime should reference the golang-adk image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 }
 
 func TestRuntime_CustomRepositoryPath_WithSkillsUsesFullTag(t *testing.T) {
@@ -485,5 +490,6 @@ func TestRuntime_CustomRepositoryPath_WithSkillsUsesFullTag(t *testing.T) {
 	require.Len(t, deployment.Spec.Template.Spec.Containers, 1)
 	container := deployment.Spec.Template.Spec.Containers[0]
 	assert.Contains(t, container.Image, "my-registry.com/custom/golang-adk", "Image should use custom repository with golang-adk")
-	assert.Contains(t, container.Image, "@sha256:test-go-full", "Go runtime with skills should use digest-pinned golang-adk-full image")
+	assert.Contains(t, container.Image, ":"+translator.DefaultImageConfig.Tag+"-full", "Go runtime with skills should reference the golang-adk full image by tag")
+	assert.NotContains(t, container.Image, "@sha256:", "regular agents must not use digest-pinned images")
 }
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json
index 4e531abee..e2cb0e84b 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json
@@ -186,7 +186,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json
index 1ad025792..acd88ecdc 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json
@@ -196,7 +196,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json
index f9e03a9be..c959a47d6 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json
@@ -193,7 +193,7 @@
                     "value": "/config/srt-settings.json"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json
index 01a686903..16b91cefd 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json
@@ -207,7 +207,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json
index 664bc75f6..283963cd9 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json
@@ -202,7 +202,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json
index 20026198a..26de14963 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json
@@ -155,7 +155,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json
index 1ad34fd0c..1f8ba2ae2 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json
@@ -155,7 +155,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json
index 100ec227e..d018d872c 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json
@@ -202,7 +202,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json
index 9fa55238e..67a8e8a2f 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json
@@ -180,7 +180,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json
index dd5efe2e7..70907d7ec 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json
@@ -215,7 +215,7 @@
                     "value": "/config/srt-settings.json"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json
index 35ca0459a..bd5f97ca4 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json
@@ -195,7 +195,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json
index 5f230e078..440b385ba 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json
@@ -191,7 +191,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json
index 293e4128e..940037c66 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json
@@ -191,7 +191,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json
index 7dc1de4f4..4183fe912 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json
@@ -189,7 +189,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json
index 906f21eb4..2cf612297 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json
@@ -173,7 +173,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json
index bdf0db026..8a7f398b7 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json
@@ -193,7 +193,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json
index a062fc5fb..666a1fb10 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json
@@ -202,7 +202,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json
index 96a1be7af..1dab97f4c 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json
@@ -191,7 +191,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json
index 08a33603f..ce1409ab7 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json
@@ -194,7 +194,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json
index fc67d52f4..66199196a 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json
@@ -194,7 +194,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json
index 7486e2248..4a03d166d 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json
@@ -193,7 +193,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json
index 382d4d051..e592026a1 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json
@@ -197,7 +197,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json
index f9bfdfc9f..fd9524ce3 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json
@@ -206,7 +206,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json
index 8a1325cd2..028a00956 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json
@@ -187,7 +187,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json
index 400fa7fff..3567604f7 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json
@@ -215,7 +215,7 @@
                     "value": "/config/srt-settings.json"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json
index ed58de0af..ccc3ddc1c 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json
@@ -187,7 +187,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json
index f7349005f..a8ad8d012 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json
@@ -180,7 +180,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json
index 037a830df..afb1453be 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json
@@ -180,7 +180,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json
index 80c527142..166f4b14d 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json
@@ -183,7 +183,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json
index 3d74b716e..af7e049ef 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json
@@ -187,7 +187,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json
index b7c875fb8..7f30e79f0 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json
@@ -193,7 +193,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json b/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json
index 0542775bc..409e5d175 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json
@@ -182,7 +182,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json
index 0ccfdc3b1..ea750977c 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json
@@ -185,7 +185,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json
index f6e3f69f6..1eebea8af 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json
@@ -184,7 +184,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json
index 9e7d68b17..5623a92a5 100644
--- a/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json
+++ b/go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json
@@ -185,7 +185,7 @@
                     "value": "http://kagent-controller.kagent:8083"
                   }
                 ],
-                "image": "cr.kagent.dev/kagent-dev/kagent/app@sha256:test-app",
+                "image": "cr.kagent.dev/kagent-dev/kagent/app:dev",
                 "imagePullPolicy": "IfNotPresent",
                 "name": "kagent",
                 "ports": [
diff --git a/go/core/pkg/app/app.go b/go/core/pkg/app/app.go
index 6ee09b0e8..13c2cd1fb 100644
--- a/go/core/pkg/app/app.go
+++ b/go/core/pkg/app/app.go
@@ -214,6 +214,9 @@ func (cfg *Config) SetFlags(commandLine *flag.FlagSet) {
 	commandLine.StringVar(&agent_translator.DefaultImageConfig.PullPolicy, "image-pull-policy", agent_translator.DefaultImageConfig.PullPolicy, "The pull policy to use for the image.")
 	commandLine.StringVar(&agent_translator.DefaultImageConfig.PullSecret, "image-pull-secret", "", "The pull secret name for the agent image.")
 	commandLine.StringVar(&agent_translator.DefaultImageConfig.Repository, "image-repository", agent_translator.DefaultImageConfig.Repository, "The repository to use for the agent image.")
+	commandLine.StringVar(&agent_translator.PythonADKImageDigest, "app-image-digest", agent_translator.PythonADKImageDigest, "Manifest digest (sha256:...) for the Python agent runtime image used by sandbox agents. Defaults to the digest baked in at build time; override when a mirrored registry re-assigns digests.")
+	commandLine.StringVar(&agent_translator.GoADKImageDigest, "golang-adk-image-digest", agent_translator.GoADKImageDigest, "Manifest digest (sha256:...) for the Go agent runtime image used by sandbox agents. Defaults to the digest baked in at build time; override when a mirrored registry re-assigns digests.")
+	commandLine.StringVar(&agent_translator.GoADKFullImageDigest, "golang-adk-full-image-digest", agent_translator.GoADKFullImageDigest, "Manifest digest (sha256:...) for the full Go agent runtime image used by sandbox agents. Defaults to the digest baked in at build time; override when a mirrored registry re-assigns digests.")
 	commandLine.StringVar(&agent_translator.DefaultSkillsInitImageConfig.Registry, "skills-init-image-registry", agent_translator.DefaultSkillsInitImageConfig.Registry, "The registry to use for the skills init image.")
 	commandLine.StringVar(&agent_translator.DefaultSkillsInitImageConfig.Tag, "skills-init-image-tag", agent_translator.DefaultSkillsInitImageConfig.Tag, "The tag to use for the skills init image.")
 	commandLine.StringVar(&agent_translator.DefaultSkillsInitImageConfig.PullPolicy, "skills-init-image-pull-policy", agent_translator.DefaultSkillsInitImageConfig.PullPolicy, "The pull policy to use for the skills init image.")