diff --git a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
index 49049955..2adca9c9 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
@@ -745,12 +745,17 @@ function sentinelPublishImageBuildShell(state: SentinelCicdState, jobName: strin
     "image_build_started_ms=$(now_ms)",
     "write_meta image_build_started_ms \"$image_build_started_ms\"",
     "emit_stage image-build running \"$image_build_started_ms\"",
-    "if ! env HTTP_PROXY=\"$image_build_http_proxy\" HTTPS_PROXY=\"$image_build_https_proxy\" ALL_PROXY=\"$image_build_all_proxy\" NO_PROXY=\"$image_build_no_proxy\" http_proxy=\"$image_build_http_proxy\" https_proxy=\"$image_build_https_proxy\" all_proxy=\"$image_build_all_proxy\" no_proxy=\"$image_build_no_proxy\" buildctl-daemonless.sh build --allow network.host --frontend dockerfile.v0 --local context=/workspace/source --local dockerfile=/workspace/source --opt filename=Containerfile.web-probe-sentinel --opt \"network=$image_build_network_mode\" --opt \"build-arg:HTTP_PROXY=$image_build_http_proxy\" --opt \"build-arg:HTTPS_PROXY=$image_build_https_proxy\" --opt \"build-arg:ALL_PROXY=$image_build_all_proxy\" --opt \"build-arg:NO_PROXY=$image_build_no_proxy\" --opt \"build-arg:http_proxy=$image_build_http_proxy\" --opt \"build-arg:https_proxy=$image_build_https_proxy\" --opt \"build-arg:all_proxy=$image_build_all_proxy\" --opt \"build-arg:no_proxy=$image_build_no_proxy\" --metadata-file /workspace/build-metadata.json --output \"type=image,name=$image_ref,push=true,registry.insecure=true\" > \"$build_log\" 2>&1; then cat \"$build_log\"; emit_stage image-build failed \"$image_build_started_ms\"; exit 1; fi",
+    "build_status=0",
+    "env HTTP_PROXY=\"$image_build_http_proxy\" HTTPS_PROXY=\"$image_build_https_proxy\" ALL_PROXY=\"$image_build_all_proxy\" NO_PROXY=\"$image_build_no_proxy\" http_proxy=\"$image_build_http_proxy\" https_proxy=\"$image_build_https_proxy\" all_proxy=\"$image_build_all_proxy\" no_proxy=\"$image_build_no_proxy\" buildctl-daemonless.sh build --allow network.host --frontend dockerfile.v0 --local context=/workspace/source --local dockerfile=/workspace/source --opt filename=Containerfile.web-probe-sentinel --opt \"network=$image_build_network_mode\" --opt \"build-arg:HTTP_PROXY=$image_build_http_proxy\" --opt \"build-arg:HTTPS_PROXY=$image_build_https_proxy\" --opt \"build-arg:ALL_PROXY=$image_build_all_proxy\" --opt \"build-arg:NO_PROXY=$image_build_no_proxy\" --opt \"build-arg:http_proxy=$image_build_http_proxy\" --opt \"build-arg:https_proxy=$image_build_https_proxy\" --opt \"build-arg:all_proxy=$image_build_all_proxy\" --opt \"build-arg:no_proxy=$image_build_no_proxy\" --metadata-file /workspace/build-metadata.json --output \"type=image,name=$image_ref,push=true,registry.insecure=true\" > \"$build_log\" 2>&1 || build_status=$?",
     "cat \"$build_log\"",
     "image_build_finished_ms=$(now_ms)",
     "write_meta image_build_finished_ms \"$image_build_finished_ms\"",
-    "metadata_compact=$(tr -d '\\n' < /workspace/build-metadata.json)",
+    "metadata_compact=''",
+    "if [ -s /workspace/build-metadata.json ]; then metadata_compact=$(tr -d '\\n' < /workspace/build-metadata.json); fi",
     "digest=$(printf '%s' \"$metadata_compact\" | sed -n 's/.*\"containerimage.digest\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p' | head -n 1)",
+    "if [ -z \"$digest\" ]; then digest=$(sed -n 's/.*exporting manifest \\(sha256:[0-9a-f]\\{64\\}\\).*/\\1/p' \"$build_log\" | tail -n 1); fi",
+    "if [ \"$build_status\" -ne 0 ] && [ -z \"$digest\" ]; then emit_stage image-build failed \"$image_build_started_ms\"; exit \"$build_status\"; fi",
+    "if [ \"$build_status\" -ne 0 ]; then printf '{\"event\":\"sentinel-publish-warning\",\"stage\":\"image-build\",\"warning\":\"buildctl returned non-zero after producing image digest; continuing with digest-pinned publish\",\"exitCode\":%s,\"valuesRedacted\":true}\\n' \"$build_status\" | tee -a \"$event_log\"; fi",
     "test -n \"$digest\"",
     "repo_no_tag=${image_ref%:*}",
     "digest_ref=\"$repo_no_tag@$digest\"",
diff --git a/scripts/src/platform-infra-pipelines-as-code-remote.sh b/scripts/src/platform-infra-pipelines-as-code-remote.sh
index 6dbe4028..847edef0 100644
--- a/scripts/src/platform-infra-pipelines-as-code-remote.sh
+++ b/scripts/src/platform-infra-pipelines-as-code-remote.sh
@@ -314,7 +314,7 @@ const image = publish || [...records].reverse().find((item) => item.imageStatus
 const envHeaderIndex = lines.findIndex((line) => /^ENV_REUSE\s+NODE_DEPS\s+/u.test(line.trim()));
 let humanEnv = null;
 if (envHeaderIndex >= 0) {
-  const row = (lines.slice(envHeaderIndex + 1).find((line) => line.trim() && !/^-+\s+-+/u.test(line.trim())) || '').trim().split(/\s+/u);
+  const row = (lines.slice(envHeaderIndex + 1).find((line) => line.trim()) || '').trim().split(/\s+/u);
   if (row.length >= 5) {
     humanEnv = { envReuse: row[0], nodeDeps: row[1], buildPackage: row[2], buildNetwork: row[3], cache: row[4] };
   }