diff --git a/apps-gx10/fc-updater/deployment-updatecenter-web.json b/apps-gx10/fc-updater/deployment-updatecenter-web.json
index b8993a1..73c40cf 100644
--- a/apps-gx10/fc-updater/deployment-updatecenter-web.json
+++ b/apps-gx10/fc-updater/deployment-updatecenter-web.json
@@ -199,7 +199,7 @@
                 "value": "26843545600"
               }
             ],
-            "image": "localhost/fc-updater-web:v20260618-public-exposure-6c0d0e4-r2",
+            "image": "localhost/fc-updater-web:v20260618-public-containment-8c5386e",
             "imagePullPolicy": "Never",
             "securityContext": {
               "allowPrivilegeEscalation": false,
diff --git a/tests/bluejay-infra-lint/FleetManifestLintTests.cs b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
index 2cf34aa..847cc5a 100644
--- a/tests/bluejay-infra-lint/FleetManifestLintTests.cs
+++ b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
@@ -1239,6 +1239,23 @@ public sealed class FleetManifestLintTests
         match.Should().NotContain("Method(`OPTIONS`)");
     }
 
+    [Fact]
+    public void Gx10UpdateCenterPublicIngress_StaysGetHeadOnlyAndUsesContainmentImage()
+    {
+        var appRoot = Path.Combine(Inventory.BluejayRoot, "apps-gx10", "fc-updater");
+        var publicRoute = File.ReadAllText(Path.Combine(appRoot, "ingressroute-updatecenter-web-public-gx10.json"));
+        var deployment = File.ReadAllText(Path.Combine(appRoot, "deployment-updatecenter-web.json"));
+
+        publicRoute.Should().Contain("Host(`update.flowercore.io`)");
+        publicRoute.Should().Contain("Host(`updates.flowercore.io`)");
+        publicRoute.Should().Contain("Method(`GET`)");
+        publicRoute.Should().Contain("Method(`HEAD`)");
+        publicRoute.Should().NotContain("Method(`POST`)");
+        publicRoute.Should().NotContain("Method(`OPTIONS`)");
+        deployment.Should().Contain("localhost/fc-updater-web:v20260618-public-containment-8c5386e");
+        deployment.Should().NotContain("localhost/fc-updater-web:v20260618-public-exposure-6c0d0e4-r2");
+    }
+
     [Fact]
     public void DnsAndMediaIngressRoutes_MatchLiveInternalHosts()
     {