Image must exist in the registry >=24h before Watchtower adopts it, so a compromised/broken just-pushed :latest isn't pulled instantly. Per-container override via com.centurylinklabs.watchtower.cooldown-delay. Fleet-wide. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>