diff --git a/pkg/agent/run.go b/pkg/agent/run.go
index ced5bdbc8..6fe4fa517 100644
--- a/pkg/agent/run.go
+++ b/pkg/agent/run.go
@@ -309,7 +309,11 @@ func (m *AgentManager) Start(ctx context.Context, opts api.StartOptions) (*api.A
 	// Apply image_registry rewrite to whatever image was resolved above.
 	// This rewrites the registry prefix for scion-* images. An explicit
 	// --image flag below takes full precedence (no rewrite).
-	if settings != nil && resolvedImage != "" {
+	// When image_pinned is set in the agent/template config, the image is
+	// used as-is without registry rewriting.
+	if finalScionCfg != nil && finalScionCfg.ImagePinned {
+		util.Debugf("image resolution: image_pinned=true, skipping registry rewrite")
+	} else if settings != nil && resolvedImage != "" {
 		imageRegistry := settings.ResolveImageRegistry(opts.Profile)
 		if imageRegistry != "" {
 			rewritten := config.RewriteImageRegistry(resolvedImage, imageRegistry)
diff --git a/pkg/api/types.go b/pkg/api/types.go
index 659250937..339bdb7a5 100644
--- a/pkg/api/types.go
+++ b/pkg/api/types.go
@@ -448,6 +448,7 @@ type ScionConfig struct {
 	AuthSelectedType string            `json:"auth_selectedType,omitempty" yaml:"auth_selectedType,omitempty"`
 	Resources        *ResourceSpec     `json:"resources,omitempty" yaml:"resources,omitempty"`
 	Image            string            `json:"image,omitempty" yaml:"image,omitempty"`
+	ImagePinned      bool              `json:"image_pinned,omitempty" yaml:"image_pinned,omitempty"`
 	Services         []ServiceSpec     `json:"services,omitempty" yaml:"services,omitempty"`
 	// MCPServers is the universal MCP server map. Keys are server names; values
 	// are the transport-agnostic config translated by each harness's