:latest never rolls. The tag moves when a build publishes, but nothing tells the Deployment: the pod template is unchanged, so Kubernetes has no reason to replace anything. Nothing else covers it either. This image is deliberately not enrolled in Flux image automation — kubernetes/infrastructure/image-automation/README.md lists ghcr.io/konairius/ical-proxy as having "only main, latest, and main-<sha> commit builds; no release tags", so no ImagePolicy watches it. The two pods have been running a 21-day-old image while :latest moved underneath them, and the only way to pick up a new build was a manual restart, which leaves no record anywhere. Pinning makes the rollout a git change. Flux applies the new pod template, Kubernetes rolls it, and what is RUNNING becomes recoverable from this repo instead of "whatever :latest meant the last time a pod happened to restart". main-99a912b is the merge of konairius/ical-proxy#12, which adds the summary_match and summary_replace parameters. The waste calendar needs them to strip "| Abfuhrkalender - Landkreis Amberg-Sulzbach" from every collection — the feed repeats the whole calendar's name on each event, and no consumer can shorten it after the fact. Bumping this tag is now a manual, reviewed edit. Format is main-<short-sha>, from docker/metadata-action type=sha with the branch as prefix.