diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9ff1a1f..d54c2b9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,14 +39,12 @@ jobs:
           ./scripts/build_image.py \
             --stellar-cli-version "${{ steps.pair.outputs.cli }}" \
             --rust-version "${{ steps.pair.outputs.rust }}" \
-            --rust-image-digest "${{ steps.pair.outputs.digest }}"
       - name: smoke test
         run: |
           ./scripts/smoke_test_image.py \
             --image "${{ steps.pair.outputs.image }}" \
             --stellar-cli-version "${{ steps.pair.outputs.cli }}" \
             --rust-version "${{ steps.pair.outputs.rust }}" \
-            --rust-image-digest "${{ steps.pair.outputs.digest }}"
       - name: wasm reproducibility
         run: |
           ./scripts/repro_test.py \
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5996a76..12618a7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -109,6 +109,7 @@ jobs:
             RUST_VERSION=${{ matrix.rust_version }}
             RUST_BASE_SUFFIX=${{ matrix.rust_base_suffix }}
             RUST_IMAGE_DIGEST=${{ matrix.rust_image_digest }}
+            CLI_RUST_IMAGE_DIGEST=${{ matrix.cli_rust_image_digest }}
             STELLAR_CLI_REV=${{ matrix.stellar_cli_ref }}
             STELLAR_CLI_VERSION=${{ matrix.stellar_cli_version }}
             BUILD_DATE=${{ steps.meta.outputs.build_date }}
diff --git a/Dockerfile b/Dockerfile
index 5aa1320..2b45554 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,12 +15,17 @@
 ARG RUST_VERSION
 ARG RUST_BASE_SUFFIX
 ARG RUST_IMAGE_DIGEST
+# Falls back to RUST_IMAGE_DIGEST so direct `docker build` usage keeps working
+# without supplying CLI_RUST_IMAGE_DIGEST. The build scripts and CI always set
+# it explicitly (from cli_rust_version) so the builder stage can diverge from
+# the final stage's base image.
+ARG CLI_RUST_IMAGE_DIGEST=${RUST_IMAGE_DIGEST}
 ARG STELLAR_CLI_REV
 ARG STELLAR_CLI_VERSION
 ARG BUILD_DATE
 ARG SOURCE_REPO
 
-FROM rust@${RUST_IMAGE_DIGEST} AS builder
+FROM rust@${CLI_RUST_IMAGE_DIGEST} AS builder
 ARG STELLAR_CLI_REV
 ARG STELLAR_CLI_VERSION
 SHELL ["/bin/bash", "-eo", "pipefail", "-c"]
diff --git a/README.md b/README.md
index b29c5b4..4dc20e6 100644
--- a/README.md
+++ b/README.md
@@ -102,10 +102,12 @@ compare the resulting WASM sha256.
 ./scripts/validate_json.py
 
 # Build a local image for a declared (cli, rust base) pair. The rust base is
-# given as the label plus its pinned digest (copy the pin from builds.json).
+# given as the label; the digest is resolved from builds.json automatically.
 ./scripts/build_image.py --stellar-cli-version 26.0.0 \
-  --rust-version 1.94.0-slim-trixie \
-  --rust-image-digest sha256:f7bf1c266d9e48c8d724733fd97ba60464c44b743eb4f46f935577d3242d81d0
+  --rust-version 1.94.0-slim-trixie
+
+# Only when a label carries more than one digest in builds.json do you need
+# --rust-image-digest to say which pin to build.
 
 # Smoke-test the built image.
 docker run --rm stellar-cli:26.0.0-rust1.94.0-slim-trixie --version
diff --git a/RELEASE.md b/RELEASE.md
index a3a5890..7764bc6 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -102,11 +102,11 @@ The script prints the chosen release tag as its final stdout line. Commit and pu
 
 ```sh
 ./scripts/validate_json.py
-# --rust-version is the label; --rust-image-digest is the pin's digest from
-# builds.json (it pins the FROM and is cross-checked against the image's
+# --rust-version is the label; build_image.py resolves its pinned digest from
+# builds.json (the digest pins the FROM and is cross-checked against the image's
 # org.opencontainers.image.base.digest label). The built tag is label-only.
-./scripts/build_image.py --stellar-cli-version 26.1.0 --rust-version 1.95.0-slim-trixie \
-  --rust-image-digest sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0
+# Pass --rust-image-digest only when one label carries multiple digests.
+./scripts/build_image.py --stellar-cli-version 26.1.0 --rust-version 1.95.0-slim-trixie
 ./scripts/smoke_test_image.py --image stellar-cli:26.1.0-rust1.95.0-slim-trixie \
   --stellar-cli-version 26.1.0 --rust-version 1.95.0-slim-trixie \
   --rust-image-digest sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0
diff --git a/builds.json b/builds.json
index b3ff10e..38dd78f 100644
--- a/builds.json
+++ b/builds.json
@@ -4,24 +4,148 @@
   "default_distro": "trixie",
   "stellar_cli_versions": [
     {
+      "cli_rust_version": "1.90.0-slim-bookworm@sha256:64232e656c058f4468e8d024e990acff04f0fd5a5c0a88a574dc37773d7325c9",
+      "ref": "8c559e832fd969aa469784b66e70891fadf94f0a",
+      "rust_versions": [
+        "1.88.0-slim-trixie@sha256:9a7159329166b45f453351a077367f501aa3e98378f7e327530e7966a139d05f",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.91.1-slim-trixie@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
+        "1.94.0-slim-trixie@sha256:f7bf1c266d9e48c8d724733fd97ba60464c44b743eb4f46f935577d3242d81d0"
+      ],
+      "version": "23.2.0"
+    },
+    {
+      "cli_rust_version": "1.90.0-slim-bookworm@sha256:64232e656c058f4468e8d024e990acff04f0fd5a5c0a88a574dc37773d7325c9",
+      "ref": "496ac35be7a7d8d923fcde9bbbc650ee593d1f6f",
+      "rust_versions": [
+        "1.85.0-slim-bookworm@sha256:1829c432be4a592f3021501334d3fcca24f238432b13306a4e62669dec538e52",
+        "1.86.0-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944",
+        "1.87.0-slim-bookworm@sha256:437507c3e719e4f968033b88d851ffa9f5aceeb2dcc2482cc6cb7647811a55eb",
+        "1.89.0-slim-trixie@sha256:8cffb8fe4e8a95cf0d6a2060375e5a28aff4c752155aa9f1f9193530769bdf66",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.91.1-slim-trixie@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8",
+        "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0"
+      ],
+      "version": "23.2.1"
+    },
+    {
+      "cli_rust_version": "1.90.0-slim-bookworm@sha256:64232e656c058f4468e8d024e990acff04f0fd5a5c0a88a574dc37773d7325c9",
+      "ref": "08473ac20016c369067ce0dbca91d9595e72d6d4",
+      "rust_versions": [
+        "1.85.0-slim-bookworm@sha256:1829c432be4a592f3021501334d3fcca24f238432b13306a4e62669dec538e52",
+        "1.88.0-slim-trixie@sha256:9a7159329166b45f453351a077367f501aa3e98378f7e327530e7966a139d05f",
+        "1.89.0-slim-trixie@sha256:8cffb8fe4e8a95cf0d6a2060375e5a28aff4c752155aa9f1f9193530769bdf66",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.91.1-slim-trixie@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
+        "1.93.1-slim-trixie@sha256:c0a38f5662afdb298898da1d70b909af4bda4e0acff2dc52aea6360a9b9c6956"
+      ],
+      "version": "23.3.0"
+    },
+    {
+      "cli_rust_version": "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
+      "ref": "fc6745f3d4e90d1ef68d14d0ae947404768fa5c0",
+      "rust_versions": [
+        "1.85.0-slim-bookworm@sha256:1829c432be4a592f3021501334d3fcca24f238432b13306a4e62669dec538e52",
+        "1.88.0-slim-trixie@sha256:9a7159329166b45f453351a077367f501aa3e98378f7e327530e7966a139d05f",
+        "1.89.0-slim-trixie@sha256:8cffb8fe4e8a95cf0d6a2060375e5a28aff4c752155aa9f1f9193530769bdf66",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.91.1-slim-trixie@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
+        "1.93.0-slim-trixie@sha256:760ad1d638d70ebbd0c61e06210e1289cbe45ff6425e3ea6e01241de3e14d08e",
+        "1.93.1-slim-trixie@sha256:c0a38f5662afdb298898da1d70b909af4bda4e0acff2dc52aea6360a9b9c6956",
+        "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0"
+      ],
+      "version": "23.4.0"
+    },
+    {
+      "cli_rust_version": "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
+      "ref": "a152ec2488c25136808ad28277c24b3a0765ffd4",
+      "rust_versions": [
+        "1.85.0-slim-bookworm@sha256:1829c432be4a592f3021501334d3fcca24f238432b13306a4e62669dec538e52",
+        "1.86.0-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944",
+        "1.89.0-slim-trixie@sha256:8cffb8fe4e8a95cf0d6a2060375e5a28aff4c752155aa9f1f9193530769bdf66",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.91.1-slim-trixie@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
+        "1.93.0-slim-trixie@sha256:760ad1d638d70ebbd0c61e06210e1289cbe45ff6425e3ea6e01241de3e14d08e",
+        "1.93.1-slim-trixie@sha256:c0a38f5662afdb298898da1d70b909af4bda4e0acff2dc52aea6360a9b9c6956"
+      ],
+      "version": "23.4.1"
+    },
+    {
+      "cli_rust_version": "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
+      "ref": "a64925e9391c3d3b3ef8e53dc60c23db9e6a82e4",
+      "rust_versions": [
+        "1.87.0-slim-bookworm@sha256:437507c3e719e4f968033b88d851ffa9f5aceeb2dcc2482cc6cb7647811a55eb",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
+        "1.93.0-slim-trixie@sha256:760ad1d638d70ebbd0c61e06210e1289cbe45ff6425e3ea6e01241de3e14d08e",
+        "1.93.1-slim-trixie@sha256:c0a38f5662afdb298898da1d70b909af4bda4e0acff2dc52aea6360a9b9c6956"
+      ],
+      "version": "25.0.0"
+    },
+    {
+      "cli_rust_version": "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
       "ref": "a048a57a75762458b487052e0021ea704a926bee",
       "rust_versions": [
-        "1.90.0-slim-bookworm@sha256:64232e656c058f4468e8d024e990acff04f0fd5a5c0a88a574dc37773d7325c9"
+        "1.86.0-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944",
+        "1.87.0-slim-bookworm@sha256:437507c3e719e4f968033b88d851ffa9f5aceeb2dcc2482cc6cb7647811a55eb",
+        "1.88.0-slim-trixie@sha256:9a7159329166b45f453351a077367f501aa3e98378f7e327530e7966a139d05f",
+        "1.89.0-slim-trixie@sha256:8cffb8fe4e8a95cf0d6a2060375e5a28aff4c752155aa9f1f9193530769bdf66",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.91.1-slim-trixie@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
+        "1.93.0-slim-trixie@sha256:760ad1d638d70ebbd0c61e06210e1289cbe45ff6425e3ea6e01241de3e14d08e",
+        "1.93.1-slim-trixie@sha256:c0a38f5662afdb298898da1d70b909af4bda4e0acff2dc52aea6360a9b9c6956",
+        "1.94.0-slim-trixie@sha256:f7bf1c266d9e48c8d724733fd97ba60464c44b743eb4f46f935577d3242d81d0",
+        "1.94.1-slim-trixie@sha256:cf09adf8c3ebaba10779e5c23ff7fe4df4cccdab8a91f199b0c142c53fef3e1a",
+        "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
+        "1.96.0-slim-trixie@sha256:26abcef3d79b8d890c4ceb17093154573e1f6479cf6dd7c1450043b8458350f6"
       ],
       "version": "25.1.0"
     },
     {
+      "cli_rust_version": "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
+      "ref": "28484880988199233a7e8e87c97cb12dac323cb3",
+      "rust_versions": [
+        "1.86.0-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944",
+        "1.89.0-slim-trixie@sha256:8cffb8fe4e8a95cf0d6a2060375e5a28aff4c752155aa9f1f9193530769bdf66",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.91.1-slim-trixie@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
+        "1.93.0-slim-trixie@sha256:760ad1d638d70ebbd0c61e06210e1289cbe45ff6425e3ea6e01241de3e14d08e",
+        "1.93.1-slim-trixie@sha256:c0a38f5662afdb298898da1d70b909af4bda4e0acff2dc52aea6360a9b9c6956",
+        "1.94.0-slim-trixie@sha256:f7bf1c266d9e48c8d724733fd97ba60464c44b743eb4f46f935577d3242d81d0",
+        "1.94.1-slim-trixie@sha256:cf09adf8c3ebaba10779e5c23ff7fe4df4cccdab8a91f199b0c142c53fef3e1a",
+        "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0"
+      ],
+      "version": "25.2.0"
+    },
+    {
+      "cli_rust_version": "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
       "ref": "60f7458e7ecffddf2f2d91dc6d0d2db4fab03ecc",
       "rust_versions": [
+        "1.85.0-slim-bookworm@sha256:1829c432be4a592f3021501334d3fcca24f238432b13306a4e62669dec538e52",
+        "1.88.0-slim-trixie@sha256:9a7159329166b45f453351a077367f501aa3e98378f7e327530e7966a139d05f",
+        "1.90.0-slim-trixie@sha256:7fa728f3678acf5980d5db70960cf8491aff9411976789086676bdf0c19db39e",
+        "1.92.0-slim-trixie@sha256:bf3368a992915f128293ac76917ab6e561e4dda883273c8f5c9f6f8ea37a378e",
         "1.93.0-slim-trixie@sha256:760ad1d638d70ebbd0c61e06210e1289cbe45ff6425e3ea6e01241de3e14d08e",
-        "1.94.0-slim-trixie@sha256:f7bf1c266d9e48c8d724733fd97ba60464c44b743eb4f46f935577d3242d81d0"
+        "1.93.1-slim-trixie@sha256:c0a38f5662afdb298898da1d70b909af4bda4e0acff2dc52aea6360a9b9c6956",
+        "1.94.0-slim-trixie@sha256:f7bf1c266d9e48c8d724733fd97ba60464c44b743eb4f46f935577d3242d81d0",
+        "1.94.1-slim-trixie@sha256:cf09adf8c3ebaba10779e5c23ff7fe4df4cccdab8a91f199b0c142c53fef3e1a",
+        "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0"
       ],
       "version": "26.0.0"
     },
     {
+      "cli_rust_version": "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
       "ref": "1228cff8022b804659750b94b315932b0e0f3f6a",
       "rust_versions": [
-        "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0"
+        "1.89.0-slim-trixie@sha256:8cffb8fe4e8a95cf0d6a2060375e5a28aff4c752155aa9f1f9193530769bdf66",
+        "1.95.0-slim-trixie@sha256:e14e87345b4d5964ddcc3491d27ee046a0f23820f340c3c1e24da6880141f7c0",
+        "1.96.0-slim-trixie@sha256:26abcef3d79b8d890c4ceb17093154573e1f6479cf6dd7c1450043b8458350f6"
       ],
       "version": "26.1.0"
     }
diff --git a/builds.schema.json b/builds.schema.json
index 05b116c..2b7585d 100644
--- a/builds.schema.json
+++ b/builds.schema.json
@@ -40,12 +40,16 @@
       "items": {
         "additionalProperties": false,
         "properties": {
+          "cli_rust_version": {
+            "$ref": "#/definitions/rust_pin",
+            "description": "Fully-qualified rust base pin (<rust_base_key>@<image_digest>) to build this stellar-cli release - not the same as the rustc used to compile contracts"
+          },
           "ref": {
             "$ref": "#/definitions/git_sha",
             "description": "Upstream stellar/stellar-cli git commit SHA for this release. Source of truth; version is metadata."
           },
           "rust_versions": {
-            "description": "Append-only list of fully-qualified rust base pins (<rust_base_key>@<image_digest>) this stellar-cli release was ever built against. Refreshes append the picker's freshly-resolved pins; previously-published pins are retained so the file stays consistent with the immutable tags in the registry. The same label may appear more than once with distinct digests (e.g. a rebuilt base) — each pin is its own immutable image.",
+            "description": "Append-only list of fully-qualified rust base pins (<rust_base_key>@<image_digest>) this stellar-cli release was ever built against. Refreshes append the picker's freshly-resolved pins; previously-published pins are retained so the file stays consistent with the immutable tags in the registry. The same label may appear more than once with distinct digests (e.g. a rebuilt base) \u2014 each pin is its own immutable image.",
             "items": {
               "$ref": "#/definitions/rust_pin"
             },
diff --git a/scripts/build_image.py b/scripts/build_image.py
index 5057a46..74bebbe 100755
--- a/scripts/build_image.py
+++ b/scripts/build_image.py
@@ -17,7 +17,7 @@ def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     parser.add_argument("--stellar-cli-version", required=True, metavar="V")
     parser.add_argument("--rust-version", required=True, metavar="KEY")
-    parser.add_argument("--rust-image-digest", required=True, metavar="DIGEST")
+    parser.add_argument("--rust-image-digest", default=None, metavar="DIGEST")
     parser.add_argument("--platform", default="", metavar="P")
     parser.add_argument("--tag", default="", metavar="REF")
     parser.add_argument("--source-repo", default="stellar/stellar-cli-docker", metavar="SLUG")
@@ -29,13 +29,15 @@ def main(argv: list[str] | None = None) -> int:
     common.preflight_checks(["buildx"])
 
     data = builds.load()
-    rust_digest = args.rust_image_digest
     try:
-        builds.assert_pair_declared(
-            data, args.stellar_cli_version, f"{args.rust_version}@{rust_digest}"
+        rust_digest = builds.resolve_rust_digest(
+            data, args.stellar_cli_version, args.rust_version, args.rust_image_digest
         )
         stellar_ref = builds.stellar_cli_ref(data, args.stellar_cli_version)
         parsed = rust_keys.parse(args.rust_version)
+        entry = builds.find_cli(data, args.stellar_cli_version)
+        cli_rust_pin = entry.get("cli_rust_version") if entry else None
+        cli_rust_digest = builds.digest_of(cli_rust_pin) if cli_rust_pin else rust_digest
     except ValueError as exc:
         common.die(str(exc))
 
@@ -48,6 +50,7 @@ def main(argv: list[str] | None = None) -> int:
     common.log(f"building {tag}")
     common.log(f"  stellar-cli {args.stellar_cli_version}         ({stellar_ref})")
     common.log(f"  rust {args.rust_version}           ({rust_digest})")
+    common.log(f"  cli-build rust                ({cli_rust_digest})")
     common.log(f"  base rust:{parsed.version}-{parsed.suffix}")
     common.log(f"  platform {args.platform or '<host native>'}")
 
@@ -63,6 +66,8 @@ def main(argv: list[str] | None = None) -> int:
         "--build-arg",
         f"RUST_IMAGE_DIGEST={rust_digest}",
         "--build-arg",
+        f"CLI_RUST_IMAGE_DIGEST={cli_rust_digest}",
+        "--build-arg",
         f"STELLAR_CLI_REV={stellar_ref}",
         "--build-arg",
         f"STELLAR_CLI_VERSION={args.stellar_cli_version}",
diff --git a/scripts/lib/builds.py b/scripts/lib/builds.py
index 3d169a6..4ff0d76 100644
--- a/scripts/lib/builds.py
+++ b/scripts/lib/builds.py
@@ -81,6 +81,35 @@ def assert_pair_declared(data: dict[str, Any], cli: str, rust_pin: str) -> None:
         )
 
 
+def resolve_rust_digest(
+    data: dict[str, Any], cli: str, label: str, digest: str | None = None
+) -> str:
+    """Resolve the pinned base digest for a (cli, rust label) pair.
+
+    When `digest` is given, assert the exact `<label>@<digest>` pin is declared
+    and return it. When `digest` is omitted, return the sole digest declared for
+    the label; raise if the label is undeclared, or if it carries more than one
+    digest (the caller must then disambiguate with an explicit digest).
+    """
+    if digest is not None:
+        assert_pair_declared(data, cli, f"{label}@{digest}")
+        return digest
+
+    entry = find_cli(data, cli)
+    if entry is None:
+        raise ValueError(f"unknown stellar-cli version: {cli}")
+    pins = [pin for pin in entry.get("rust_versions", []) if label_of(pin) == label]
+    if not pins:
+        raise ValueError(f"stellar-cli {cli} is not declared with rust base {label} in builds.json")
+    if len(pins) > 1:
+        choices = ", ".join(digest_of(pin) for pin in pins)
+        raise ValueError(
+            f"stellar-cli {cli} declares multiple digests for rust base {label}; "
+            f"pass --rust-image-digest to select one of: {choices}"
+        )
+    return digest_of(pins[0])
+
+
 def derive_default_rust(data: dict[str, Any], cli: str) -> str:
     distro = data.get("default_distro")
     if not distro:
diff --git a/scripts/resolve_matrix.py b/scripts/resolve_matrix.py
index a980d48..df373ff 100755
--- a/scripts/resolve_matrix.py
+++ b/scripts/resolve_matrix.py
@@ -26,6 +26,8 @@ def build_matrix(data: dict, only_cli: str = "") -> dict:
         if only_cli and cli != only_cli:
             continue
         ref = entry["ref"]
+        cli_rust_pin = entry.get("cli_rust_version")
+        cli_rust_image_digest = builds.digest_of(cli_rust_pin) if cli_rust_pin else None
         # The published tag is label-only, so only the newest pin per label is
         # built — the last occurrence in rust_versions wins. builds.json keeps
         # the superseded pins as history; they are not rebuilt or republished.
@@ -38,6 +40,7 @@ def build_matrix(data: dict, only_cli: str = "") -> dict:
                 rows.append(
                     {
                         "arch": arch,
+                        "cli_rust_image_digest": cli_rust_image_digest or digest,
                         "platform": f"linux/{arch}",
                         "rust_base_id": rust_base_id,
                         "rust_base_key": label,
diff --git a/tag_info.txt b/tag_info.txt
new file mode 100644
index 0000000..944c51e
--- /dev/null
+++ b/tag_info.txt
@@ -0,0 +1,55 @@
+Tag stats (source: versions.sqlite, 3613 wasm files)
+
+1. No cli version ......................... 2586
+2. With cli version, -nightly rust ........    32
+3. With cli version, stable rust .........   995
+                                           ------
+   total ................................. 3613
+
+Notes:
+- "no cli version" = cliver meta absent (older contracts predating the cliver field).
+- Of the 1027 with a cli version, all have a non-empty rsver; 32 are -nightly, the rest stable.
+
+stellar-cli releases (source: github.com/stellar/stellar-cli releases API)
+
+cliver meta was added in v23.2.0, released 2025-11-14.
+
+Soroban Mainnet released February 20, 2024
+Last stellar-cli release before then was v20.3.0 on February 6, 2024
+
+The following 34 versions are likely to have been used to deploy contracts on Soroban mainnet and may need docker images as well. 
+
+* v20.3.0
+* v20.3.1
+* v20.3.4
+* v21.0.0
+* v21.1.0
+* v21.1.1
+* v21.2.0
+* v21.3.0
+* v21.4.0
+* v21.4.1
+* v21.5.0
+* v21.5.1
+* v21.5.2
+* v21.5.3
+* v22.0.0
+* v22.0.1
+* v22.1.0
+* v22.2.0
+* v22.3.0
+* v22.4.0
+* v22.5.0
+* v22.6.0
+* v22.7.0
+* v22.8.0
+* v22.8.1
+* v22.8.2
+* v23.0.0
+* v23.0.1
+* v23.1.1
+* v23.1.2
+* v23.1.3
+* v23.1.4
+* v23.2.0
+* v23.2.1
diff --git a/tags.csv b/tags.csv
new file mode 100644
index 0000000..3ce9392
--- /dev/null
+++ b/tags.csv
@@ -0,0 +1,132 @@
+rsver,cliver,count
+1.96.0,26.1.0,16
+1.95.0,26.1.0,15
+1.89.0,26.1.0,1
+1.95.0,26.0.0,71
+1.94.1,26.0.0,29
+1.94.0,26.0.0,2
+1.93.1,26.0.0,3
+1.93.0,26.0.0,64
+1.92.0,26.0.0,16
+1.90.0,26.0.0,8
+1.88.0,26.0.0,9
+1.85.0,26.0.0,3
+1.96.0-nightly,25.2.0,3
+1.95.0,25.2.0,23
+1.94.1,25.2.0,45
+1.94.0,25.2.0,43
+1.93.1,25.2.0,18
+1.93.0,25.2.0,18
+1.92.0,25.2.0,8
+1.91.1,25.2.0,2
+1.91.0-nightly,25.2.0,3
+1.90.0-nightly,25.2.0,1
+1.90.0,25.2.0,9
+1.89.0,25.2.0,1
+1.86.0,25.2.0,2
+1.96.0-nightly,25.1.0,1
+1.96.0,25.1.0,5
+1.95.0-nightly,25.1.0,2
+1.95.0,25.1.0,25
+1.94.1,25.1.0,14
+1.94.0,25.1.0,15
+1.93.1,25.1.0,32
+1.93.0,25.1.0,38
+1.92.0,25.1.0,36
+1.91.1,25.1.0,3
+1.90.0,25.1.0,31
+1.89.0,25.1.0,11
+1.88.0,25.1.0,9
+1.87.0,25.1.0,6
+1.86.0,25.1.0,1
+1.93.1,25.0.0,4
+1.93.0,25.0.0,9
+1.92.0,25.0.0,24
+1.91.0-nightly,25.0.0,10
+1.90.0,25.0.0,15
+1.87.0,25.0.0,5
+1.96.0-nightly,23.4.1,3
+1.93.1,23.4.1,1
+1.93.0,23.4.1,1
+1.92.0,23.4.1,32
+1.91.1,23.4.1,5
+1.90.0,23.4.1,5
+1.89.0,23.4.1,1
+1.86.0,23.4.1,2
+1.85.0,23.4.1,4
+1.95.0,23.4.0,5
+1.93.1,23.4.0,2
+1.93.0,23.4.0,9
+1.92.0,23.4.0,14
+1.91.1,23.4.0,12
+1.90.0,23.4.0,1
+1.89.0,23.4.0,9
+1.88.0,23.4.0,2
+1.85.0,23.4.0,2
+1.93.1,23.3.0,2
+1.92.0,23.3.0,15
+1.91.1,23.3.0,28
+1.90.0,23.3.0,1
+1.89.0,23.3.0,2
+1.88.0,23.3.0,3
+1.85.0,23.3.0,2
+1.84.1,23.3.0,1
+1.84.0,23.3.0,40
+1.81.0,23.3.0,1
+1.95.0,23.2.1,1
+1.91.1,23.2.1,26
+1.90.0,23.2.1,16
+1.89.0,23.2.1,1
+1.87.0,23.2.1,2
+1.86.0,23.2.1,5
+1.85.0,23.2.1,1
+1.94.0-nightly,23.2.0,9
+1.94.0,23.2.0,36
+1.92.0,23.2.0,2
+1.91.1,23.2.0,9
+1.90.0,23.2.0,4
+1.88.0,23.2.0,1
+1.97.0-nightly,"",1
+1.96.0,"",9
+1.95.0,"",50
+1.94.1,"",40
+1.94.0-nightly,"",3
+1.94.0,"",55
+1.93.1,"",66
+1.93.0-nightly,"",23
+1.93.0,"",96
+1.92.0-nightly,"",23
+1.92.0,"",103
+1.91.1,"",108
+1.91.0-nightly,"",24
+1.91.0,"",69
+1.90.0-nightly,"",5
+1.90.0,"",109
+1.89.0,"",153
+1.88.0,"",127
+1.87.0-nightly,"",10
+1.87.0,"",145
+1.86.0,"",138
+1.85.1,"",33
+1.85.0-nightly,"",2
+1.85.0,"",81
+1.84.1,"",39
+1.84.0,"",41
+1.83.0,"",40
+1.82.0,"",134
+1.81.0-nightly,"",1
+1.81.0,"",260
+1.80.1,"",37
+1.80.0,"",60
+1.79.0,"",109
+1.78.0-nightly,"",2
+1.78.0,"",86
+1.77.2,"",48
+1.77.1,"",9
+1.77.0,"",13
+1.76.0-nightly,"",30
+1.76.0,"",81
+1.75.0,"",45
+1.74.1,"",52
+1.74.0,"",15
+"","",11
diff --git a/tests/unit/test_build_image.py b/tests/unit/test_build_image.py
index 78ffd05..f882019 100644
--- a/tests/unit/test_build_image.py
+++ b/tests/unit/test_build_image.py
@@ -90,6 +90,65 @@ def test_main_respects_custom_tag(monkeypatch: pytest.MonkeyPatch, minimal_build
     assert "my-local:test" in args
 
 
+def test_main_infers_digest_when_unambiguous(
+    monkeypatch: pytest.MonkeyPatch, minimal_builds: dict
+) -> None:
+    # minimal_builds declares 26.0.0 with a single 1.94.0-slim-trixie pin, so the
+    # digest can be resolved without --rust-image-digest.
+    monkeypatch.setattr(build_image.builds, "load", lambda: minimal_builds)
+    monkeypatch.setattr(build_image.common, "preflight_checks", lambda _: None)
+    captured = MagicMock(return_value=_completed())
+    monkeypatch.setattr(build_image.runner, "run", captured)
+
+    rc = build_image.main(
+        [
+            "--stellar-cli-version",
+            "26.0.0",
+            "--rust-version",
+            "1.94.0-slim-trixie",
+        ]
+    )
+
+    # Expect the sole digest the fixture declares for this (cli, label), so the
+    # assertion can't drift from the digest build_image actually infers.
+    expected_digest = minimal_builds["stellar_cli_versions"][0]["rust_versions"][0].split("@", 1)[1]
+    assert rc == 0
+    args = captured.call_args[0][0]
+    assert f"RUST_IMAGE_DIGEST={expected_digest}" in args
+
+
+def test_main_dies_when_digest_omitted_and_ambiguous(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # Two digests share the 1.94.0-slim-trixie label → the digest must be given.
+    ambiguous = {
+        "default_distro": "trixie",
+        "stellar_cli_versions": [
+            {
+                "ref": "a" * 40,
+                "version": "26.0.0",
+                "rust_versions": [
+                    "1.94.0-slim-trixie@sha256:" + "a" * 64,
+                    "1.94.0-slim-trixie@sha256:" + "b" * 64,
+                ],
+            }
+        ],
+    }
+    monkeypatch.setattr(build_image.builds, "load", lambda: ambiguous)
+    monkeypatch.setattr(build_image.common, "preflight_checks", lambda _: None)
+    monkeypatch.setattr(build_image.runner, "run", lambda *_, **__: _completed())
+
+    with pytest.raises(SystemExit):
+        build_image.main(
+            [
+                "--stellar-cli-version",
+                "26.0.0",
+                "--rust-version",
+                "1.94.0-slim-trixie",
+            ]
+        )
+
+
 def test_main_dies_for_undeclared_pair(
     monkeypatch: pytest.MonkeyPatch, minimal_builds: dict
 ) -> None:
diff --git a/tests/unit/test_builds.py b/tests/unit/test_builds.py
index eff3654..66772b0 100644
--- a/tests/unit/test_builds.py
+++ b/tests/unit/test_builds.py
@@ -103,6 +103,49 @@ def test_assert_pair_declared_rejects_undeclared_pair(multi_cli_builds: dict) ->
         builds.assert_pair_declared(multi_cli_builds, "25.1.0", _PIN_94)
 
 
+def test_resolve_rust_digest_returns_sole_digest(minimal_builds: dict) -> None:
+    # One pin for the label → digest is unambiguous, no explicit digest needed.
+    assert builds.resolve_rust_digest(minimal_builds, "26.0.0", "1.94.0-slim-trixie") == _DIGEST_94
+
+
+def test_resolve_rust_digest_honors_explicit_digest(multi_cli_builds: dict) -> None:
+    assert (
+        builds.resolve_rust_digest(multi_cli_builds, "26.0.0", "1.94.0-slim-trixie", _DIGEST_94)
+        == _DIGEST_94
+    )
+
+
+def test_resolve_rust_digest_rejects_explicit_undeclared_pin(multi_cli_builds: dict) -> None:
+    with pytest.raises(ValueError, match="not declared"):
+        builds.resolve_rust_digest(
+            multi_cli_builds, "26.0.0", "1.94.0-slim-trixie", "sha256:" + "0" * 64
+        )
+
+
+def test_resolve_rust_digest_rejects_undeclared_label(minimal_builds: dict) -> None:
+    with pytest.raises(ValueError, match="not declared"):
+        builds.resolve_rust_digest(minimal_builds, "26.0.0", "1.99.0-slim-trixie")
+
+
+def test_resolve_rust_digest_requires_digest_when_ambiguous() -> None:
+    # Same label carrying two digests → caller must disambiguate.
+    data = {
+        "default_distro": "trixie",
+        "stellar_cli_versions": [
+            {
+                "ref": "a" * 40,
+                "version": "26.0.0",
+                "rust_versions": [
+                    "1.94.0-slim-trixie@sha256:" + "a" * 64,
+                    "1.94.0-slim-trixie@sha256:" + "b" * 64,
+                ],
+            }
+        ],
+    }
+    with pytest.raises(ValueError, match="multiple digests"):
+        builds.resolve_rust_digest(data, "26.0.0", "1.94.0-slim-trixie")
+
+
 def test_derive_default_rust_picks_highest_matching_suffix(multi_cli_builds: dict) -> None:
     assert builds.derive_default_rust(multi_cli_builds, "26.0.0") == _PIN_94
 
diff --git a/tests/unit/test_resolve_matrix.py b/tests/unit/test_resolve_matrix.py
index f79055f..51e656e 100644
--- a/tests/unit/test_resolve_matrix.py
+++ b/tests/unit/test_resolve_matrix.py
@@ -28,6 +28,7 @@ def test_build_matrix_row_carries_expected_keys(minimal_builds: dict) -> None:
     row = matrix["include"][0]
     assert set(row.keys()) == {
         "arch",
+        "cli_rust_image_digest",
         "platform",
         "rust_base_id",
         "rust_base_key",