Whenever images are built, what versions are actually installed in them? That can be managed by freezing an environment, but doing that can be problematic unless done from within the image to be used. This can be done relatively easy though, as done in https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/HEAD/images/hub/README.md.
It can also be automated from a github workflow relatively easy, it can for example be manually triggered, that way one doesn't even have to do something locally and can get an update via githubs UI entirely. See this as an example of doing that.