It seems the previous version of the provider (v3) always added a suffix to the end of the provided tag, which would make it unique on each run. Subsequently, the k8s deployment would notice this and update the deployment.
You can try adding the suffix yourself to the image tag, making it unique on each execution, returning to the previous behavior. If you manage to compile a SHA related to the files on the image, you may even retain the benefit of not generating a new image in case nothing changes between pulumi executions.