A build pulls a container base image whose tag has changed. Which TWO controls improve reproducibility? Select TWO.

1. Review dependency updates through the normal testing and promotion workflow.
2. Pin and record the approved base image digest.
3. Treat the image's familiar name as proof of unchanged contents.
4. Disable all vulnerability checks permanently.