diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9224f3d..0b5d33e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -167,7 +167,7 @@ jobs:
           printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
           docker push "$RUNTIME_IMAGE"
           digest="$("$LOCKED_BUILDX" imagetools inspect "$RUNTIME_IMAGE" \
-            --format '{{.Manifest.Digest}}')"
+            --format '{{json .Manifest}}' | jq -er '.digest')"
           [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
           printf 'digest=%s\n' "$digest" >> "$GITHUB_OUTPUT"
 
diff --git a/scripts/check-source-gates b/scripts/check-source-gates
index db1ba7f..06fa9e4 100755
--- a/scripts/check-source-gates
+++ b/scripts/check-source-gates
@@ -465,6 +465,8 @@ require_marker .github/workflows/release.yml 'workflow_dispatch:' ECR_SYNC_RELEA
 require_marker .github/workflows/release.yml 'export DOCKER_CONFIG="$docker_config_root"' ECR_SYNC_RELEASE_BUILDER_CONFIG_MISSING
 require_marker .github/workflows/release.yml 'if [ -d LICENSES ]; then' ECR_SYNC_OPTIONAL_LICENSE_DIRECTORY_GATE_MISSING
 require_marker .github/workflows/release.yml '--version "${RELEASE_TAG#v}"' ECR_SYNC_RELEASE_SBOM_VERSION_BINDING_MISSING
+require_marker .github/workflows/release.yml "--format '{{json .Manifest}}' | jq -er '.digest'" ECR_SYNC_RELEASE_REMOTE_DIGEST_GATE_MISSING
+reject_marker .github/workflows/release.yml '{{.Manifest.Digest}}' ECR_SYNC_RELEASE_INVALID_DIGEST_TEMPLATE_PRESENT
 require_marker .github/workflows/supply-chain.yml '--version "${VERSION_OVERRIDE#v}"' ECR_SYNC_REVIEW_SBOM_VERSION_BINDING_MISSING
 require_marker .github/workflows/release.yml '.metadata.component.version == $version' ECR_SYNC_RELEASE_SBOM_VERSION_READBACK_MISSING
 require_marker .github/workflows/supply-chain.yml '.metadata.component.version == $version' ECR_SYNC_REVIEW_SBOM_VERSION_READBACK_MISSING