When a new version is built, it is placed in the registry with a unique name. The production environment then fetches exactly that version, so it is always clear what is running and which version applied before.
We have our own container registry, Harbor, in our own environment. Every image is scanned for known vulnerabilities before it may go live. A version with critical vulnerabilities that can be fixed is stopped.