abra recipe upgrade is the first approach, but it silently contributes no candidate for tag+digest pins (FATA: tag and digest not supported), digest-only pins, and non-semver tags. immich kept getting skipped this way. Before concluding SKIPPED — up-to-date, do a direct upstream tag check for every image abra could not cleanly evaluate; only skip when BOTH agree nothing is newer.