diff --git a/tests/unit/python/utils/docker/test_image_pin.py b/tests/unit/python/utils/docker/test_image_pin.py
index 1b7b7e949f..a8737c8157 100644
--- a/tests/unit/python/utils/docker/test_image_pin.py
+++ b/tests/unit/python/utils/docker/test_image_pin.py
@@ -33,11 +33,18 @@ class TestPinClass(unittest.TestCase):
         self.assertEqual(pin_class(f"  {DIGEST_VALUE}  "), DIGEST)
         self.assertEqual(pin_class("  3.0.1  "), SEMVER)
 
-    def test_every_class_has_its_own_rule(self):
-        rules = [RULE_BY_CLASS[SEMVER], RULE_BY_CLASS[DIGEST], RULE_BY_CLASS[REF]]
+    def test_a_digest_declares_itself_apart_from_a_tag(self):
+        self.assertNotEqual(
+            RULE_BY_CLASS[DIGEST],
+            RULE_BY_CLASS[REF],
+            "a digest is chosen for a reason a non-semver tag never carries, so "
+            "the two cannot share one marker",
+        )
+        self.assertEqual(RULE_BY_CLASS[DIGEST], "docker-digest")
+        self.assertEqual(RULE_BY_CLASS[REF], "docker-version")
 
-        self.assertEqual(len(set(rules)), 3, "a shared rule cannot express intent")
-        self.assertEqual(rules, ["docker-version", "docker-digest", "docker-ref"])
+    def test_a_semver_pin_needs_no_declaration(self):
+        self.assertNotIn(SEMVER, RULE_BY_CLASS)
 
 
 class TestPullReference(unittest.TestCase):
diff --git a/utils/docker/image/pin.py b/utils/docker/image/pin.py
index 4ddfce88e5..11b4ec7e41 100644
--- a/utils/docker/image/pin.py
+++ b/utils/docker/image/pin.py
@@ -7,9 +7,8 @@ DIGEST = "digest"
 REF = "ref"
 
 RULE_BY_CLASS = {
-    SEMVER: "docker-version",
     DIGEST: "docker-digest",
-    REF: "docker-ref",
+    REF: "docker-version",
 }