A platform team adopts immutable machine images. A new critical patch becomes available. Which response best follows that operating model?

1. Disable vulnerability scanning after image approval
2. Build and validate a patched image, then replace instances through a controlled rollout
3. Keep compromised instances indefinitely to avoid configuration change
4. Patch a few instances manually and leave the image unchanged