A deployment must use one exact immutable container image rather than whichever artifact a mutable tag points to later. Which approach best fits?

1. Use customer-managed encryption keys through Cloud KMS.
2. Store credentials in Secret Manager and grant runtime read access narrowly.
3. Deploy an image referenced by its digest.
4. Use Artifact Registry repositories with appropriate IAM roles.