diff --git a/.kiro/specs/plane-on-kubernetes/tasks.md b/.kiro/specs/plane-on-kubernetes/tasks.md
index 11eb44e..fbec09c 100644
--- a/.kiro/specs/plane-on-kubernetes/tasks.md
+++ b/.kiro/specs/plane-on-kubernetes/tasks.md
@@ -36,7 +36,7 @@ go-ahead** with a ceiling; steps that need a hand on a cluster that does not exi
     `ax-tunnel`; fails listing `path:line`.
   - Evidence: the test passes on this commit and fails when a literal is reinserted (shown once in the record).
   - _Requirements: 1.3_
-- [ ] 1.4 `up.sh` by profile
+- [x] 1.4 `up.sh` by profile
   - `ops/ax/up.sh`: `KO_DOCKER_REPO` and the context from `kind.toml` (read with `python -m
     openultrasast.plane.profile --print registry|kube_context`); writes `kind-images.json` instead of
     `runner-image`; `generate.repin_templates` accepts that file (runner key only until task 4.3).
diff --git a/ops/ax/README.md b/ops/ax/README.md
index 17eca5c..44bfad3 100644
--- a/ops/ax/README.md
+++ b/ops/ax/README.md
@@ -12,7 +12,10 @@ single-node kind cluster. ax is the only executor; `ousast plane run` submits, r
     ops/ax/down.sh        # deletes the cluster and its registry
 
 Tools live in `~/go/bin` (kind, ax, ko, kubectl-ate) and `~/.local/bin` (kubectl); sources and rendered files
-in `~/.cache/ousast/ax-src/` (the runner digest pin is `runner-image` there).
+in `~/.cache/ousast/ax-src/`. The cluster's context, registry and pool sizes come from the kind profile
+(`ops/k8s/profiles/kind.toml`); `up.sh` writes the runner's digest pin to that profile's images file
+(`ops/k8s/profiles/kind-images.json`), which the templates are re-pinned from and which is committed with them.
+`up.sh` and `smoke-run.sh` run the checkout's code with `OUSAST_PYTHON` (default `.venv/bin/python`).
 
 ## How a Run executes
 
diff --git a/ops/ax/smoke-run.sh b/ops/ax/smoke-run.sh
index bb49312..09c7c80 100755
--- a/ops/ax/smoke-run.sh
+++ b/ops/ax/smoke-run.sh
@@ -1,14 +1,18 @@
 #!/usr/bin/env bash
-# Render the end-to-end smoke Run with the current runner digest and execute it through the reconciler on ax.
+# Render the end-to-end smoke Run with the profile's runner digest and execute it through the reconciler on ax.
+# The profile (OUSAST_PLANE_PROFILE, default kind; ops/k8s/profiles/) names the images file up.sh wrote.
 set -euo pipefail
 export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
 SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}"
-RUNNER_IMAGE="$(cat "$SRC/runner-image")"; export RUNNER_IMAGE
+REPO="$(cd "$(dirname "$0")/../.." && pwd)"
+PY="${OUSAST_PYTHON:-$REPO/.venv/bin/python}"
+RUNNER_IMAGE="$(PYTHONPATH="$REPO/src" "$PY" -m openultrasast.plane.profile --profile "${OUSAST_PLANE_PROFILE:-kind}" --print images.runner)"
+export RUNNER_IMAGE
 # Actors reach the receiver by its Service name through the egress gateway (ops/ax/receiver-service.yaml.tmpl,
 # applied by up.sh, endpoint this host at OUSAST_ARTIFACT_PORT): the runner dials the Service's ClusterIP on port
 # 80 with that name as Host; the reconciler looks the ClusterIP up unless OUSAST_ARTIFACT_DIAL is set.
 export OUSAST_ARTIFACT_PORT="${OUSAST_ARTIFACT_PORT:-18090}"
 envsubst < "$(dirname "$0")/smoke-run.yaml.tmpl" > "$SRC/smoke-run.yaml"
-REPO="$(cd "$(dirname "$0")/../.." && pwd)"
-"$REPO/.venv/bin/ousast" plane run "$SRC/smoke-run.yaml" "$@"
-"$REPO/.venv/bin/ousast" plane status ax-e2e-smoke
+ousast() { PYTHONPATH="$REPO/src" "$PY" -m openultrasast.cli "$@"; }   # this checkout's code, whatever python runs it
+ousast plane run "$SRC/smoke-run.yaml" "$@"
+ousast plane status ax-e2e-smoke
diff --git a/ops/ax/up.sh b/ops/ax/up.sh
index a5a85c6..2d2af49 100755
--- a/ops/ax/up.sh
+++ b/ops/ax/up.sh
@@ -1,13 +1,21 @@
 #!/usr/bin/env bash
 # Bring up ax on this host: kind cluster + local registry, Agent Substrate, the ax control plane, one smoke
-# Task. Idempotent enough to rerun; `down.sh` removes everything. Requires docker, go, kubectl, kind, ko, ax.
+# Task. Idempotent: every step is skipped when already done; `down.sh` removes everything. Requires docker, go,
+# kubectl, kind, ko, ax. The cluster's context, the registry and the pool sizes come from the kind profile
+# (ops/k8s/profiles/kind.toml; OUSAST_PLANE_PROFILE selects another file with exec = "local"). This script may
+# name the kind cluster because it creates it; the code reads the profile (tests/test_plane_literals.py).
 set -euo pipefail
 trap 'rc=$?; echo "up.sh FAILED at line $LINENO (exit $rc)"' ERR
 trap 'echo "up.sh exit $?"' EXIT
 export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
 export GOTOOLCHAIN=auto
-export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-ousast}"
-export KO_DOCKER_REPO="${KO_DOCKER_REPO:-localhost:5001}"
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PY="${OUSAST_PYTHON:-$REPO_ROOT/.venv/bin/python}"
+profile() { PYTHONPATH="$REPO_ROOT/src" "$PY" -m openultrasast.plane.profile --profile "${OUSAST_PLANE_PROFILE:-kind}" --print "$@"; }
+CTX="$(profile kube_context)"                       # kind names its context kind-<cluster>
+export KIND_CLUSTER_NAME="${CTX#kind-}"
+export KO_DOCKER_REPO="${KO_DOCKER_REPO:-$(profile registry)}"
+IMAGES_FILE="$(profile images)"                     # the digest pins the reconciler and the templates read
 SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}"
 
 for t in docker go kubectl kind ko ax; do
@@ -19,9 +27,8 @@ clone substrate https://github.com/agent-substrate/substrate.git
 clone ax https://github.com/google/ax.git
 step() { printf '\n== %s (%s)\n' "$1" "$(date +%H:%M:%S)"; }
 
-step "kind cluster '$KIND_CLUSTER_NAME' + registry $KO_DOCKER_REPO"
+step "kind cluster '$KIND_CLUSTER_NAME' (context $CTX) + registry $KO_DOCKER_REPO"
 # Each step is skipped when already done: the substrate helper DELETES an existing cluster before creating one.
-CTX="kind-$KIND_CLUSTER_NAME"
 ready() { kubectl --context "$CTX" -n "$1" get pods --no-headers 2>/dev/null | awk '$2 ~ /^[0-9]+\/[0-9]+$/ {n++; split($2,a,"/"); if (a[1]!=a[2] && $3!="Completed") bad++} END {exit !(n>0 && bad==0)}'; }
 if kind get clusters 2>/dev/null | grep -qx "$KIND_CLUSTER_NAME"; then
   echo "cluster exists; kept"
@@ -56,25 +63,36 @@ KIND_GATEWAY="$(docker network inspect kind --format '{{range .IPAM.Config}}{{if
 export KIND_GATEWAY OUSAST_ARTIFACT_PORT="${OUSAST_ARTIFACT_PORT:-18090}"   # the reconciler's fixed receiver port
 envsubst < "$(dirname "$0")/receiver-service.yaml.tmpl" | kubectl --context "$CTX" apply -f -
 
-step "worker pool (gVisor)"
+step "worker pool (gVisor): pools.default of the profile"
+# `ko apply` builds the worker image from the Substrate checkout (several GB of Go caches): only when the pool
+# is absent. A size change in the profile is applied with `kubectl patch` or by deleting the pool first.
+export POOL_NAME=ousast-pool POOL_REPLICAS="$(profile pools.default.replicas)" POOL_CPU="$(profile pools.default.cpu)" POOL_MEMORY="$(profile pools.default.memory)"
+export WORKER_IMAGE="ko://github.com/agent-substrate/substrate/cmd/ateom-gvisor"
 SUBSTRATE_VERSION="$(kubectl --context "$CTX" get nodes -o jsonpath='{.items[0].metadata.labels.ate\.dev/substrate-version}')"
 export SUBSTRATE_VERSION
 envsubst < "$(dirname "$0")/workerpool.yaml.tmpl" > "$SRC/workerpool.yaml"
-(cd "$SRC/substrate" && KO_DOCKER_REPO="$KO_DOCKER_REPO" ko apply -f "$SRC/workerpool.yaml")
-kubectl --context "$CTX" -n ax-system wait --for=condition=Ready pod -l ate.dev/worker-pool=ousast-pool --timeout=600s \
+if kubectl --context "$CTX" -n ax-system get workerpool "$POOL_NAME" >/dev/null 2>&1; then
+  echo "pool $POOL_NAME exists ($(kubectl --context "$CTX" -n ax-system get workerpool "$POOL_NAME" -o jsonpath='{.status.readyReplicas}/{.spec.replicas}') ready); kept"
+else
+  (cd "$SRC/substrate" && KO_DOCKER_REPO="$KO_DOCKER_REPO" ko apply -f "$SRC/workerpool.yaml")
+fi
+kubectl --context "$CTX" -n ax-system wait --for=condition=Ready pod -l "ate.dev/worker-pool=$POOL_NAME" --timeout=600s \
   || kubectl --context "$CTX" -n ax-system get pods
 
 step "runner image $KO_DOCKER_REPO/ousast-runner"
-REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 docker build -q -f "$REPO_ROOT/plane/Dockerfile.runner" -t "$KO_DOCKER_REPO/ousast-runner:dev" "$REPO_ROOT"
 docker push -q "$KO_DOCKER_REPO/ousast-runner:dev"
 RUNNER_IMAGE="$(docker inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$KO_DOCKER_REPO/ousast-runner:dev" | grep "^$KO_DOCKER_REPO/ousast-runner@" | head -1)"
 [ -n "$RUNNER_IMAGE" ] || { echo "no digest for the runner image" >&2; exit 2; }
-export RUNNER_IMAGE; echo "$RUNNER_IMAGE" > "$SRC/runner-image"   # the reconciler reads this pin
-echo "runner image $RUNNER_IMAGE"
+export RUNNER_IMAGE
+printf '{\n  "runner": "%s"\n}\n' "$RUNNER_IMAGE" > "$IMAGES_FILE"   # the profile's images file: commit it with the templates
+echo "runner image $RUNNER_IMAGE -> $IMAGES_FILE"
+echo "re-pin the templates with: ousast plane workspaces ... --runner-image $IMAGES_FILE (or ousast plane repin, task 4.3)"
 
 step "ax CLI from the deployed checkout (a release CLI skews from the server)"
-(cd "$SRC/ax" && go install ./cmd/ax)
+if [ -x "$HOME/go/bin/ax" ] && [ "$HOME/go/bin/ax" -nt "$SRC/ax/.git/HEAD" ]; then echo "ax CLI newer than the checkout; kept"; else
+  (cd "$SRC/ax" && go install ./cmd/ax)
+fi
 
 step "smoke task"
 ax delete task ousast-smoke >/dev/null 2>&1 || true
diff --git a/ops/ax/workerpool.yaml.tmpl b/ops/ax/workerpool.yaml.tmpl
index f71cdcf..346029d 100644
--- a/ops/ax/workerpool.yaml.tmpl
+++ b/ops/ax/workerpool.yaml.tmpl
@@ -1,23 +1,26 @@
-# Warm gVisor workers for ax tasks on this host (Agent Substrate WorkerPool). ax's per-task ActorTemplates
-# set no workerSelector, so every pool of the matching sandbox class is eligible. Two workers of 1 CPU /
-# 1.5 GiB fit the 7 GB host beside the control planes; an actor occupies a whole worker.
+# Warm gVisor workers for ax tasks (Agent Substrate WorkerPool), rendered by ops/ax/up.sh (and by
+# ops/ax/probe-placement.sh for the placement probe) from the profile's pool: POOL_NAME, POOL_REPLICAS, POOL_CPU,
+# POOL_MEMORY (ops/k8s/profiles/<profile>.toml, [pools.default]) and WORKER_IMAGE (ko:// for a build, or a
+# digest-pinned reference of a built worker image). ax's per-task ActorTemplates set no workerSelector, so every
+# pool of the matching sandbox class is eligible. An actor occupies a whole worker. Replaced by the renderer of
+# plane-on-kubernetes task 6.1 (ops/k8s/base/workerpool-*.yaml.tmpl).
 apiVersion: ate.dev/v1alpha1
 kind: WorkerPool
 metadata:
-  name: ousast-pool
+  name: ${POOL_NAME}
   namespace: ax-system
   labels:
     workload: ousast
 spec:
-  replicas: 2
-  workerImage: ko://github.com/agent-substrate/substrate/cmd/ateom-gvisor
+  replicas: ${POOL_REPLICAS}
+  workerImage: ${WORKER_IMAGE}
   template:
     nodeSelector:
       ate.dev/substrate-version: "${SUBSTRATE_VERSION}"
     resources:
       limits:
-        cpu: "1"
-        memory: 1536Mi
+        cpu: "${POOL_CPU}"
+        memory: ${POOL_MEMORY}
       requests:
         cpu: 250m
-        memory: 1536Mi
+        memory: ${POOL_MEMORY}
diff --git a/ops/k8s/profiles/kind-images.json b/ops/k8s/profiles/kind-images.json
index 16e396f..b93ec68 100644
--- a/ops/k8s/profiles/kind-images.json
+++ b/ops/k8s/profiles/kind-images.json
@@ -1,3 +1,3 @@
 {
-  "runner": "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  "runner": "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
 }
diff --git a/plane/tasks/agree.yaml b/plane/tasks/agree.yaml
index 75fa308..4f18e73 100644
--- a/plane/tasks/agree.yaml
+++ b/plane/tasks/agree.yaml
@@ -7,7 +7,7 @@ metadata:
   name: agree
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["agree"]
   resources:
     requests:
diff --git a/plane/tasks/alerts.yaml b/plane/tasks/alerts.yaml
index d17f5fc..29e430a 100644
--- a/plane/tasks/alerts.yaml
+++ b/plane/tasks/alerts.yaml
@@ -7,7 +7,7 @@ metadata:
   name: alerts
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["alerts"]
   resources:
     requests:
diff --git a/plane/tasks/features.yaml b/plane/tasks/features.yaml
index e844fd4..0702303 100644
--- a/plane/tasks/features.yaml
+++ b/plane/tasks/features.yaml
@@ -7,7 +7,7 @@ metadata:
   name: features
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["features"]
   resources:
     requests:
diff --git a/plane/tasks/loop.yaml b/plane/tasks/loop.yaml
index 926e6c1..c4efda3 100644
--- a/plane/tasks/loop.yaml
+++ b/plane/tasks/loop.yaml
@@ -7,7 +7,7 @@ metadata:
   name: loop
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["loop"]
   resources:
     requests:
diff --git a/plane/tasks/remember.yaml b/plane/tasks/remember.yaml
index 85f7af9..3ce9f7c 100644
--- a/plane/tasks/remember.yaml
+++ b/plane/tasks/remember.yaml
@@ -7,7 +7,7 @@ metadata:
   name: remember
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["remember"]
   resources:
     requests:
diff --git a/plane/tasks/repo-facts.yaml b/plane/tasks/repo-facts.yaml
index 8ebc7fb..8d300b0 100644
--- a/plane/tasks/repo-facts.yaml
+++ b/plane/tasks/repo-facts.yaml
@@ -8,7 +8,7 @@ metadata:
   name: repo-facts
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["repo-facts"]
   resources:
     requests:
diff --git a/plane/tasks/roles.yaml b/plane/tasks/roles.yaml
index 8ba31c2..92380d8 100644
--- a/plane/tasks/roles.yaml
+++ b/plane/tasks/roles.yaml
@@ -11,7 +11,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["roles"]
   resources:
     requests:
diff --git a/plane/tasks/validation-46.yaml b/plane/tasks/validation-46.yaml
index 7ab64e1..856711d 100644
--- a/plane/tasks/validation-46.yaml
+++ b/plane/tasks/validation-46.yaml
@@ -5,9 +5,9 @@ metadata:
   name: repo-facts-budibase-mongo-template-nosqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"b4ef709df34ab08c","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"b7e63df737eede85d951aa9665b0c0778ece7ccb","repo":"github.com/Budibase/budibase"}'
+    openultrasast.io/memory-key: '{"candidates":"b4ef709df34ab08c","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"b7e63df737eede85d951aa9665b0c0778ece7ccb","repo":"github.com/Budibase/budibase"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -36,7 +36,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -67,7 +67,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -96,7 +96,7 @@ metadata:
   name: agree-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -123,9 +123,9 @@ metadata:
   name: repo-facts-cct-studio-server-cmdi
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"6c9fa4a6e47cda37","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"acdb5893412a81eaec9862ee24a4613bf296ab45","repo":"github.com/davila7/claude-code-templates"}'
+    openultrasast.io/memory-key: '{"candidates":"6c9fa4a6e47cda37","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"acdb5893412a81eaec9862ee24a4613bf296ab45","repo":"github.com/davila7/claude-code-templates"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -154,7 +154,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -185,7 +185,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -214,7 +214,7 @@ metadata:
   name: agree-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -241,9 +241,9 @@ metadata:
   name: repo-facts-contextforge-prompt-ssti
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"b272af6456664ebc","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"0f8e0ad679f1fff685f486e17f642ac863c8ca9e","repo":"github.com/IBM/mcp-context-forge"}'
+    openultrasast.io/memory-key: '{"candidates":"b272af6456664ebc","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"0f8e0ad679f1fff685f486e17f642ac863c8ca9e","repo":"github.com/IBM/mcp-context-forge"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -272,7 +272,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -303,7 +303,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -332,7 +332,7 @@ metadata:
   name: agree-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -359,9 +359,9 @@ metadata:
   name: repo-facts-froxlor-admin-ip-second-order-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"c52240d980ef0105","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"9bf03de643a2edee4642bfc6c94db1f05253da02","repo":"github.com/froxlor/froxlor"}'
+    openultrasast.io/memory-key: '{"candidates":"c52240d980ef0105","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"9bf03de643a2edee4642bfc6c94db1f05253da02","repo":"github.com/froxlor/froxlor"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -390,7 +390,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -421,7 +421,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -450,7 +450,7 @@ metadata:
   name: agree-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -477,9 +477,9 @@ metadata:
   name: repo-facts-fuxa-tdengine-escape-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"ec699ee54d38a8ee","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"193a888f8e3f805325072829b1644a2c768c948b","repo":"github.com/frangoteam/FUXA"}'
+    openultrasast.io/memory-key: '{"candidates":"ec699ee54d38a8ee","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"193a888f8e3f805325072829b1644a2c768c948b","repo":"github.com/frangoteam/FUXA"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -508,7 +508,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -539,7 +539,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -568,7 +568,7 @@ metadata:
   name: agree-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -595,9 +595,9 @@ metadata:
   name: repo-facts-lmdeploy-media-url-ssrf
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"1337c9c717f5ac87","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"71648d239c978452720a6d6692fe914efc8a7b94","repo":"github.com/InternLM/lmdeploy"}'
+    openultrasast.io/memory-key: '{"candidates":"1337c9c717f5ac87","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"71648d239c978452720a6d6692fe914efc8a7b94","repo":"github.com/InternLM/lmdeploy"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -626,7 +626,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -657,7 +657,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -686,7 +686,7 @@ metadata:
   name: agree-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -713,9 +713,9 @@ metadata:
   name: repo-facts-medplum-external-auth-open-redirect
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"17ba609d5b1a1a00","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"5d4a8654b02aa67c444f96ae1eb5663c09854006","repo":"github.com/medplum/medplum"}'
+    openultrasast.io/memory-key: '{"candidates":"17ba609d5b1a1a00","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"5d4a8654b02aa67c444f96ae1eb5663c09854006","repo":"github.com/medplum/medplum"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -744,7 +744,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -775,7 +775,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -804,7 +804,7 @@ metadata:
   name: agree-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -831,9 +831,9 @@ metadata:
   name: repo-facts-pgadmin-maintenance-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"7f1b83a88024c2d4","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"d112dc3b962218efc3613fa727d54f0fc5b1d527","repo":"github.com/pgadmin-org/pgadmin4"}'
+    openultrasast.io/memory-key: '{"candidates":"7f1b83a88024c2d4","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"d112dc3b962218efc3613fa727d54f0fc5b1d527","repo":"github.com/pgadmin-org/pgadmin4"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -862,7 +862,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -893,7 +893,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -922,7 +922,7 @@ metadata:
   name: agree-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -949,9 +949,9 @@ metadata:
   name: repo-facts-qwed-sympy-eval
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"f071e8db5f5517ab","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"06801f68cbf9c9b5e54cc17f2a61cb2792da7a26","repo":"github.com/QWED-AI/qwed-verification"}'
+    openultrasast.io/memory-key: '{"candidates":"f071e8db5f5517ab","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"06801f68cbf9c9b5e54cc17f2a61cb2792da7a26","repo":"github.com/QWED-AI/qwed-verification"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -980,7 +980,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1011,7 +1011,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1040,7 +1040,7 @@ metadata:
   name: agree-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1067,9 +1067,9 @@ metadata:
   name: repo-facts-reactpress-findall-column-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"ecb82a10249c6fed","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"c3dd10681b3d2b5e224f7ac647b3769557603975","repo":"github.com/fecommunity/reactpress"}'
+    openultrasast.io/memory-key: '{"candidates":"ecb82a10249c6fed","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"c3dd10681b3d2b5e224f7ac647b3769557603975","repo":"github.com/fecommunity/reactpress"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1098,7 +1098,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1129,7 +1129,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1158,7 +1158,7 @@ metadata:
   name: agree-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1185,9 +1185,9 @@ metadata:
   name: repo-facts-unleash-addon-webhook-ssrf
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"4d3debd51fd86f9c","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"b9f3217d327f24094b4352130baa30387f85cffe","repo":"github.com/Unleash/unleash"}'
+    openultrasast.io/memory-key: '{"candidates":"4d3debd51fd86f9c","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"b9f3217d327f24094b4352130baa30387f85cffe","repo":"github.com/Unleash/unleash"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1216,7 +1216,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1247,7 +1247,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1276,7 +1276,7 @@ metadata:
   name: agree-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1303,9 +1303,9 @@ metadata:
   name: repo-facts-winml-cli-serve-cors
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"e3b0c44298fc1c14","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"02179d185f0e3ac23518236b5ca1f61fd37ef680","repo":"github.com/microsoft/winml-cli"}'
+    openultrasast.io/memory-key: '{"candidates":"e3b0c44298fc1c14","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"02179d185f0e3ac23518236b5ca1f61fd37ef680","repo":"github.com/microsoft/winml-cli"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1334,7 +1334,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1365,7 +1365,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1394,7 +1394,7 @@ metadata:
   name: agree-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1421,9 +1421,9 @@ metadata:
   name: repo-facts-wp-directorist-avatar-ssrf
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"d6963021f588f39e","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"77cfc9bc8b453f97ab7e720330706fa4ef056867","repo":"github.com/sovware/directorist"}'
+    openultrasast.io/memory-key: '{"candidates":"d6963021f588f39e","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"77cfc9bc8b453f97ab7e720330706fa4ef056867","repo":"github.com/sovware/directorist"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1452,7 +1452,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1483,7 +1483,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1512,7 +1512,7 @@ metadata:
   name: agree-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1539,9 +1539,9 @@ metadata:
   name: repo-facts-wp-gopay-log-filter-sqli
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"626bc8b5f8d33de6eefd921e3a05ed52ac320bcd","repo":"github.com/gopaycommunity/gopay-woocommerce-integration"}'
+    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"626bc8b5f8d33de6eefd921e3a05ed52ac320bcd","repo":"github.com/gopaycommunity/gopay-woocommerce-integration"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1570,7 +1570,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1601,7 +1601,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1630,7 +1630,7 @@ metadata:
   name: agree-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1657,9 +1657,9 @@ metadata:
   name: repo-facts-wp-groundhogg-confirm-redirect
   atespace: default
   annotations:
-    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884","pin":"9472a1dd79d4556c40eece501a61930793f170d3","repo":"github.com/groundhoggwp/groundhogg"}'
+    openultrasast.io/memory-key: '{"candidates":"fde4d17144a13d73","image":"sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb","pin":"9472a1dd79d4556c40eece501a61930793f170d3","repo":"github.com/groundhoggwp/groundhogg"}'
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - repo-facts
   env:
@@ -1688,7 +1688,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1719,7 +1719,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1748,7 +1748,7 @@ metadata:
   name: agree-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - agree
   env:
@@ -1777,7 +1777,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1808,7 +1808,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1839,7 +1839,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1870,7 +1870,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1901,7 +1901,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1932,7 +1932,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1963,7 +1963,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -1994,7 +1994,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2025,7 +2025,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2056,7 +2056,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2087,7 +2087,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2118,7 +2118,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2149,7 +2149,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2180,7 +2180,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2211,7 +2211,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - verify
   env:
@@ -2240,7 +2240,7 @@ metadata:
   name: features-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2263,7 +2263,7 @@ metadata:
   name: remember-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2288,7 +2288,7 @@ metadata:
   name: features-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2311,7 +2311,7 @@ metadata:
   name: remember-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2336,7 +2336,7 @@ metadata:
   name: features-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2359,7 +2359,7 @@ metadata:
   name: remember-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2384,7 +2384,7 @@ metadata:
   name: features-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2407,7 +2407,7 @@ metadata:
   name: remember-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2432,7 +2432,7 @@ metadata:
   name: features-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2455,7 +2455,7 @@ metadata:
   name: remember-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2480,7 +2480,7 @@ metadata:
   name: features-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2503,7 +2503,7 @@ metadata:
   name: remember-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2528,7 +2528,7 @@ metadata:
   name: features-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2551,7 +2551,7 @@ metadata:
   name: remember-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2576,7 +2576,7 @@ metadata:
   name: features-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2599,7 +2599,7 @@ metadata:
   name: remember-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2624,7 +2624,7 @@ metadata:
   name: features-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2647,7 +2647,7 @@ metadata:
   name: remember-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2672,7 +2672,7 @@ metadata:
   name: features-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2695,7 +2695,7 @@ metadata:
   name: remember-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2720,7 +2720,7 @@ metadata:
   name: features-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2743,7 +2743,7 @@ metadata:
   name: remember-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2768,7 +2768,7 @@ metadata:
   name: features-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2791,7 +2791,7 @@ metadata:
   name: remember-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2816,7 +2816,7 @@ metadata:
   name: features-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2839,7 +2839,7 @@ metadata:
   name: remember-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2864,7 +2864,7 @@ metadata:
   name: features-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2887,7 +2887,7 @@ metadata:
   name: remember-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
@@ -2912,7 +2912,7 @@ metadata:
   name: features-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - features
   env:
@@ -2935,7 +2935,7 @@ metadata:
   name: remember-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884
+  image: localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb
   command:
   - remember
   env:
diff --git a/plane/tasks/verify.yaml b/plane/tasks/verify.yaml
index 2ca6050..e4b1666 100644
--- a/plane/tasks/verify.yaml
+++ b/plane/tasks/verify.yaml
@@ -10,7 +10,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: "localhost:5001/ousast-runner@sha256:412db0a1504af8f1b23a395af8d1dcbd152c1bb6d16594f2b733067163a31884"
+  image: "localhost:5001/ousast-runner@sha256:95edc7ed562189180a472df8115e6a90c8b4fcea47c06593395634bd56041bcb"
   command: ["verify"]
   resources:
     requests:
diff --git a/src/openultrasast/plane/generate.py b/src/openultrasast/plane/generate.py
index 6aa9a85..47c6e0e 100644
--- a/src/openultrasast/plane/generate.py
+++ b/src/openultrasast/plane/generate.py
@@ -45,8 +45,9 @@ The recorded triage cost is derived per file: a batched-check record's ``usd`` p
 hunts, and its ``usage`` counts only the hunts (``verify_sinks._Recording`` slices the client's usage from the
 first hunt on), so the triage share is ``usd`` minus that usage priced at the reference model's list price.
 
-``--runner-image FILE`` (``~/.cache/ousast/ax-src/runner-image``, written by ``ops/ax/up.sh``) re-pins the
-templates' ``image:`` to the digest in that file before generating, so a rebuilt image is one command.
+``--runner-image FILE`` (the profile's images file, ``ops/k8s/profiles/kind-images.json``, written by ``ops/ax/up.sh``;
+the older one-line pin file still reads) re-pins the templates' ``image:`` to the runner digest in that file before
+generating, so a rebuilt image is one command.
 """
 
 from __future__ import annotations
@@ -485,11 +486,18 @@ _IMAGE_LINE = re.compile(r'^(\s*image:\s*)"?[^"\s]+"?\s*$', re.MULTILINE)
 
 
 def repin_templates(plane: Path, image_file: Path) -> str:
-    """Set every template's ``image:`` to the digest-pinned reference in ``image_file`` (as ``ops/ax/up.sh``
-    writes it); comments and layout are kept. Returns the reference."""
-    image = image_file.read_text(encoding="utf-8").strip()
-    if not re.fullmatch(r"\S+@sha256:[0-9a-f]{64}", image):
-        raise ValueError(f"{image_file}: expected a digest-pinned image reference, got {image!r}")
+    """Set every template's ``image:`` to the runner reference of ``image_file``: a profile images file
+    (``{"runner": "<registry>/<name>@sha256:..."}``, as ``ops/ax/up.sh`` writes it) or the older one-line pin; a
+    reference without a digest is refused. Comments and layout are kept. Returns the reference. (Task 4.3 gives
+    the engine template ``images["engine"]``; until then only the runner key is read.)"""
+    from .profile import ProfileError, load_images
+
+    try:
+        image = load_images(image_file)["runner"]
+    except ProfileError as exc:
+        raise ValueError(str(exc)) from None
+    except KeyError:
+        raise ValueError(f"{image_file}: no runner image in the images file") from None
     for name in TEMPLATES:
         path = plane / "tasks" / f"{name}.yaml"
         text = path.read_text(encoding="utf-8")
diff --git a/src/openultrasast/plane/profile.py b/src/openultrasast/plane/profile.py
index c208591..d7a752c 100644
--- a/src/openultrasast/plane/profile.py
+++ b/src/openultrasast/plane/profile.py
@@ -229,7 +229,7 @@ def load_profile(name: str | None = None, environ: Mapping[str, str] | None = No
 
 def _lookup(profile: PlaneProfile, dotted: str) -> str:
     head, _, rest = dotted.partition(".")
-    if head == "images":
+    if head == "images" and rest:
         images = profile.load_images()
         if rest not in images:
             raise ProfileError(f"{profile.images}: no image named {rest!r} (have {', '.join(sorted(images))})")
diff --git a/tests/test_plane_increment.py b/tests/test_plane_increment.py
index 0afbce1..46b39b1 100644
--- a/tests/test_plane_increment.py
+++ b/tests/test_plane_increment.py
@@ -292,6 +292,23 @@ def test_case_record_carries_sites_in_set_and_cost_and_the_image_is_repinned(tmp
         repin_templates(paths["plane"], tmp_path / "runner-image")
 
 
+def test_repin_reads_the_profiles_images_file(tmp_path: Path) -> None:
+    """plane-on-kubernetes 1.4: ``ops/ax/up.sh`` writes ``kind-images.json`` ({"runner": ...}); repin reads it, the
+    older one-line pin still reads, and a file without a runner key or without a digest is refused by name."""
+    paths = _fixture(tmp_path)
+    digest = "localhost:5001/ousast-runner@sha256:" + "cd" * 32
+    images = tmp_path / "kind-images.json"
+    images.write_text(json.dumps({"runner": digest}) + "\n")
+    assert repin_templates(paths["plane"], images) == digest
+    assert {t.image for t in load_manifests(sorted((paths["plane"] / "tasks").glob("*.yaml"))).tasks.values()} == {digest}
+    images.write_text(json.dumps({"engine": digest}))
+    with pytest.raises(ValueError, match="no runner image"):
+        repin_templates(paths["plane"], images)
+    images.write_text(json.dumps({"runner": "localhost:5001/ousast-runner:dev"}))
+    with pytest.raises(ValueError, match="not digest-pinned"):
+        repin_templates(paths["plane"], images)
+
+
 def test_workspaces_go_to_the_profiles_atespace(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     """plane-on-kubernetes 1.2: ``generate.ATESPACE`` is a default; ``increment`` takes the profile's atespace."""
     paths = _fixture(tmp_path)
diff --git a/tests/test_plane_profile.py b/tests/test_plane_profile.py
index f592203..67168ba 100644
--- a/tests/test_plane_profile.py
+++ b/tests/test_plane_profile.py
@@ -144,6 +144,8 @@ def test_print_for_shell_scripts(capsys: pytest.CaptureFixture[str], tmp_path: P
     fields = ["registry", "kube_context", "images.runner", "pools.default.replicas"]
     assert profile_module.main(["--profile", str(path), "--print", *fields]) == 0
     assert capsys.readouterr().out.splitlines() == ["registry.test:5000", "kind-test", f"registry.test:5000/ousast-runner@{DIGEST}", "3"]
+    assert profile_module.main(["--profile", str(path), "--print", "images"]) == 0, "the images file's path itself (up.sh writes it)"
+    assert capsys.readouterr().out.strip() == str(tmp_path / "images.json")
     assert profile_module.main(["--profile", str(path), "--print", "images.engine"]) == 2
     assert "no image named 'engine'" in capsys.readouterr().err
     assert profile_module.main(["--profile", str(path), "--print", "nothing"]) == 2