diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml
index 95890bb4..9216a612 100644
--- a/services/hermes/chat-statefulset.yaml
+++ b/services/hermes/chat-statefulset.yaml
@@ -320,7 +320,7 @@ spec:
             requests: {cpu: 250m, memory: 256Mi}
             limits: {cpu: "1", memory: 2Gi}
         - name: webui
-          image: sha256:67a65c91e6027f382c0e912c160cc8375d7130373add9783b9289c232e7fa9e5 # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
+          image: registry.bstein.dev/bstein/hermes-webui:git-ad487b5e1c19e42b0fe574f057be13ee12b3b1dc-build-5-release@sha256:67a65c91e6027f382c0e912c160cc8375d7130373add9783b9289c232e7fa9e5 # {"$imagepolicy": "hermes:hermes-webui-release"}
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:
diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 13454204..d2f9232d 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -385,7 +385,7 @@ spec:
               cpu: "2"
               memory: 4Gi
         - name: webui
-          image: sha256:67a65c91e6027f382c0e912c160cc8375d7130373add9783b9289c232e7fa9e5 # {"$imagepolicy": "hermes:hermes-webui-release:digest"}
+          image: registry.bstein.dev/bstein/hermes-webui:git-ad487b5e1c19e42b0fe574f057be13ee12b3b1dc-build-5-release@sha256:67a65c91e6027f382c0e912c160cc8375d7130373add9783b9289c232e7fa9e5 # {"$imagepolicy": "hermes:hermes-webui-release"}
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:
diff --git a/testing/tests/test_hermes_image_automation.py b/testing/tests/test_hermes_image_automation.py
index 12b5fc9c..34836041 100644
--- a/testing/tests/test_hermes_image_automation.py
+++ b/testing/tests/test_hermes_image_automation.py
@@ -62,6 +62,14 @@ def test_flux_updates_only_the_three_hermes_image_digests() -> None:
         "path": "services/hermes",
     }
     assert agent.count('"$imagepolicy": "hermes:hermes-agent-release:digest"') == 1
-    webui_marker = '"$imagepolicy": "hermes:hermes-webui-release:digest"'
+    webui_marker = '"$imagepolicy": "hermes:hermes-webui-release"'
     assert chat.count(webui_marker) == 1
     assert dashboard.count(webui_marker) == 1
+    # A digest-only setter replaces the complete YAML scalar with ``sha256:...``.
+    # Whole-image setters must retain the registry and repository in pod specs.
+    for workload in (chat, dashboard):
+        marked_line = next(
+            line for line in workload.splitlines() if webui_marker in line
+        )
+        assert "registry.bstein.dev/bstein/hermes-webui:" in marked_line
+        assert "@sha256:" in marked_line