diff --git a/scripts/src/artifact-registry.ts b/scripts/src/artifact-registry.ts
index 717eee20..e5e76051 100644
--- a/scripts/src/artifact-registry.ts
+++ b/scripts/src/artifact-registry.ts
@@ -2050,36 +2050,44 @@ function d601K3sArtifactDeployScript(options: ArtifactRegistryOptions, spec: Art
     "  test -n \"$actual_ref\"",
     "  target_digest=$(root_exec ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images inspect \"$actual_ref\" | python3 -c 'import re,sys; m=re.search(r\"@(sha256:[0-9a-f]+)\", sys.stdin.read()); print(m.group(1) if m else \"\")')",
     "  test -n \"$target_digest\"",
-    "  python3 - \"$target_digest\" \"$key\" <<'PY'",
-    "import json",
-    "import subprocess",
-    "import sys",
-    "",
-    "digest, key = sys.argv[1:3]",
-    "base = ['ctr', '--address', '/run/k3s/containerd/containerd.sock', '-n', 'k8s.io', 'content', 'get']",
-    "",
-    "def content(ref):",
-    "    return subprocess.check_output(base + [ref])",
-    "",
-    "def labels_from(ref):",
-    "    obj = json.loads(content(ref))",
-    "    if isinstance(obj.get('manifests'), list):",
-    "        for item in obj['manifests']:",
-    "            platform = item.get('platform') or {}",
-    "            if platform.get('architecture') in ('amd64', '') or not platform:",
-    "                value = labels_from(item.get('digest', ''))",
-    "                if value:",
-    "                    return value",
-    "        return ''",
-    "    config = obj.get('config') or {}",
-    "    config_digest = config.get('digest') or ''",
-    "    if not config_digest:",
-    "        return ''",
-    "    cfg = json.loads(content(config_digest))",
-    "    return str(((cfg.get('config') or {}).get('Labels') or {}).get(key) or '')",
-    "",
-    "print(labels_from(digest))",
+    "  digest=\"$target_digest\"",
+    "  config_digest=",
+    "  while [ -n \"$digest\" ]; do",
+    "    content_file=$(mktemp /tmp/unidesk-artifact-content.XXXXXX.json)",
+    "    root_exec ctr --address /run/k3s/containerd/containerd.sock -n k8s.io content get \"$digest\" > \"$content_file\"",
+    "    next=$(python3 - \"$content_file\" <<'PY'",
+    "import json, sys",
+    "obj = json.load(open(sys.argv[1], encoding='utf-8'))",
+    "manifests = obj.get('manifests')",
+    "if isinstance(manifests, list):",
+    "    for item in manifests:",
+    "        platform = item.get('platform') or {}",
+    "        if platform.get('architecture') in ('amd64', '') or not platform:",
+    "            print('manifest:' + str(item.get('digest') or ''))",
+    "            raise SystemExit(0)",
+    "    print('')",
+    "    raise SystemExit(0)",
+    "config = obj.get('config') or {}",
+    "print('config:' + str(config.get('digest') or ''))",
     "PY",
+    "    )",
+    "    rm -f \"$content_file\"",
+    "    case \"$next\" in",
+    "      manifest:*) digest=\"${next#manifest:}\" ;;",
+    "      config:*) config_digest=\"${next#config:}\"; break ;;",
+    "      *) digest= ;;",
+    "    esac",
+    "  done",
+    "  test -n \"$config_digest\"",
+    "  config_file=$(mktemp /tmp/unidesk-artifact-config.XXXXXX.json)",
+    "  root_exec ctr --address /run/k3s/containerd/containerd.sock -n k8s.io content get \"$config_digest\" > \"$config_file\"",
+    "  python3 - \"$config_file\" \"$key\" <<'PY'",
+    "import json, sys",
+    "cfg = json.load(open(sys.argv[1], encoding='utf-8'))",
+    "key = sys.argv[2]",
+    "print(str(((cfg.get('config') or {}).get('Labels') or {}).get(key) or ''))",
+    "PY",
+    "  rm -f \"$config_file\"",
     "}",
     "image_label_commit=$(containerd_config_label \"$commit_image\" 'unidesk.ai/source-commit')",
     "image_label_service=$(containerd_config_label \"$commit_image\" 'unidesk.ai/service-id')",