We manage the ECR deployment separate from the image tags deployed in our cluster. So we have a CICD process that will trigger a new container being tagged, created, and deployed to ECR based on our rules. Then in our Pulumi config we have an image version that is consumed by the Pulumi code and we manually manage that to control what version of the container is deployed where.