diff --git a/API_CONTRACT.md b/API_CONTRACT.md
index 9f2c575..16613ae 100644
--- a/API_CONTRACT.md
+++ b/API_CONTRACT.md
@@ -215,6 +215,22 @@ always returns normalized refs. Pinning ("Pin Version") holds a container at
 its current version: it's never flagged for updates and is grouped into a
 separate section, but can still be updated by hand.
 
+### `POST /api/skip`
+
+- Auth: cookie.
+- Body: `{ "ref": "string" }` (normalized like `/api/pin`).
+- Skips the currently offered update for that image ("not this build"): the
+  item reports `updateAvailable: false, skipped: true` and it's left out of
+  notifications, until a newer build is found (which is offered as usual).
+- Response: `200 { "ok": true }`; `404 { "error": "no_pending_update" }` if
+  there's no pending update for the ref.
+
+### `DELETE /api/skip/:ref`
+
+- Auth: cookie.
+- Un-skips the pending update for `ref` (URL-encoded). Same responses as
+  `POST /api/skip`.
+
 ### `GET /api/settings`
 
 - Auth: cookie.
@@ -313,6 +329,9 @@ Field notes:
   the running and available versions mention breaking changes (best-effort,
   GitHub-sourced images only; scanned when the update event is recorded).
   `false` otherwise, including when no update is available.
+- `skipped` — `true` when an update exists but the user skipped that exact
+  build (`POST /api/skip`); `updateAvailable` is then `false`, while
+  `availableDigest`/`availableVersion` still describe the skipped build.
 - `pinned` — `true` if the image ref is in the `pinned` table ("Pin Version":
   update indicator is suppressed and the container is grouped separately, but
   a manual update is still allowed).
diff --git a/README.md b/README.md
index 8249231..eaa2de7 100644
--- a/README.md
+++ b/README.md
@@ -75,9 +75,13 @@ If the paths don't match you'll get `compose file not found` and broken bind mou
 - **Updates tab** — containers grouped by stack, update-available ones on top.
   Defaults to showing only what needs updating; flip to **All** to see everything.
   Tap **Update** to pull + recreate that service (watch live logs), or **Update all**
-  to run them one at a time. After an update DockPull verifies the container actually
+  to run them (one at a time within each stack). After an update DockPull verifies the container actually
   comes up healthy (catching crash-loops), and offers a one-click **Revert** to the
-  previous image if it doesn't. **Pin Version** holds a container at its current version.
+  previous image if it doesn't. **Pin Version** holds a container at its current version;
+  **Skip** dismisses just the update on offer, and the card returns when a newer
+  build is published. An update marked **(rebuilt)** has the same version number
+  but a new image — the publisher re-pushed the tag, usually for base-image or
+  security patches.
 - **History tab** — a log of past updates. **Clear history** wipes it (with a confirm).
 - **Settings tab** — theme, default view, auto-check on open, the **daily background
   scan** + **notifications** (Discord, ntfy, Gotify, or a generic webhook — with a
diff --git a/client/src/Dashboard.jsx b/client/src/Dashboard.jsx
index 160f3c1..aad7b54 100644
--- a/client/src/Dashboard.jsx
+++ b/client/src/Dashboard.jsx
@@ -210,7 +210,10 @@ export default function Dashboard({ onPendingCountChange }) {
   );
   const mainItems = useMemo(() => visible.filter((c) => !c.pinned), [visible]);
 
-  const pendingTargets = useMemo(() => mainItems.filter(hasUpdate).map((c) => c.name), [mainItems]);
+  const pendingTargets = useMemo(
+    () => mainItems.filter(hasUpdate).map((c) => ({ name: c.name, project: c.project })),
+    [mainItems]
+  );
 
   useEffect(() => {
     if (onPendingCountChange) onPendingCountChange(pendingTargets.length);
diff --git a/client/src/api.js b/client/src/api.js
index 01228f3..72c754b 100644
--- a/client/src/api.js
+++ b/client/src/api.js
@@ -157,6 +157,17 @@ export function unpin(ref) {
   return del(`/pin/${encodeURIComponent(ref)}`);
 }
 
+// --- Skipping a specific update ---
+
+// Dismiss the currently offered build for an image until a newer one appears.
+export function skipUpdate(ref) {
+  return post('/skip', { ref });
+}
+
+export function unskipUpdate(ref) {
+  return del(`/skip/${encodeURIComponent(ref)}`);
+}
+
 // --- Settings ---
 
 export function getSettings() {
diff --git a/client/src/components/UpdateAllButton.jsx b/client/src/components/UpdateAllButton.jsx
index 739590c..3771ff4 100644
--- a/client/src/components/UpdateAllButton.jsx
+++ b/client/src/components/UpdateAllButton.jsx
@@ -1,13 +1,15 @@
 import React, { useCallback, useState } from 'react';
 
 /**
- * Updates every container with `updateAvailable && !pinned`, all at once:
- * each is started immediately and its own SSE stream runs concurrently
- * (handled by `runUpdate`). A failure on one container does not affect the
- * others — `runUpdate` resolves (not rejects) even on failure, and
- * `Promise.allSettled` waits for them all regardless.
+ * Updates every container with `updateAvailable && !pinned`. Containers in the
+ * same stack (compose project) run one at a time — concurrent `docker compose
+ * up` calls against one project can race on its shared networks and
+ * dependencies — while different stacks proceed in parallel. A failure on one
+ * container does not stop the others: `runUpdate` resolves (never rejects)
+ * with the outcome.
  *
- * Disabled when there are no eligible targets or any update is in flight.
+ * `targets` is `[{ name, project }]`. Disabled when there are no eligible
+ * targets or any update is in flight.
  */
 export default function UpdateAllButton({ targets, runUpdate, disabled, onBatchDone }) {
   const [running, setRunning] = useState(false);
@@ -15,17 +17,28 @@ export default function UpdateAllButton({ targets, runUpdate, disabled, onBatchD
   const handleClick = useCallback(async () => {
     if (running || disabled || targets.length === 0) return;
     setRunning(true);
-    // Fire them all immediately, then wait for the whole batch to settle.
-    // Each run() resolves (never rejects) with { success, message }, so the
-    // dashboard can show one aggregate summary instead of making the user
-    // scroll every card to find what failed.
-    const outcomes = await Promise.all(
-      targets.map((name) =>
-        Promise.resolve(runUpdate(name))
-          .then((r) => ({ name, success: !!(r && r.success), message: (r && r.message) || '' }))
-          .catch((err) => ({ name, success: false, message: err?.message || '' }))
-      )
+    const runOne = (name) =>
+      Promise.resolve(runUpdate(name))
+        .then((r) => ({ name, success: !!(r && r.success), message: (r && r.message) || '' }))
+        .catch((err) => ({ name, success: false, message: err?.message || '' }));
+
+    // One sequential lane per stack; standalone containers each get their own.
+    const lanes = new Map();
+    for (const t of targets) {
+      const key = t.project ? `p:${t.project}` : `c:${t.name}`;
+      if (!lanes.has(key)) lanes.set(key, []);
+      lanes.get(key).push(t.name);
+    }
+    // Each run() resolves with { success, message }, so the dashboard can show
+    // one aggregate summary instead of making the user scroll every card.
+    const laneOutcomes = await Promise.all(
+      [...lanes.values()].map(async (names) => {
+        const out = [];
+        for (const name of names) out.push(await runOne(name));
+        return out;
+      })
     );
+    const outcomes = laneOutcomes.flat();
     setRunning(false);
     if (onBatchDone) onBatchDone(outcomes);
   }, [running, disabled, targets, runUpdate, onBatchDone]);
@@ -33,7 +46,7 @@ export default function UpdateAllButton({ targets, runUpdate, disabled, onBatchD
   return (
     <button
       type="button"
-      className="btn btn-primary"
+      className="btn btn-primary btn-sm"
       onClick={handleClick}
       disabled={disabled || running || targets.length === 0}
     >
diff --git a/client/src/components/UpdateCard.jsx b/client/src/components/UpdateCard.jsx
index bd95e9d..d65da43 100644
--- a/client/src/components/UpdateCard.jsx
+++ b/client/src/components/UpdateCard.jsx
@@ -1,5 +1,5 @@
 import React, { useCallback, useEffect, useState } from 'react';
-import { pin, unpin, getChangelog } from '../api.js';
+import { pin, unpin, skipUpdate, unskipUpdate, getChangelog } from '../api.js';
 import { useUpdateRunner } from '../hooks/useUpdateRunner.js';
 import StatusMessage from './StatusMessage.jsx';
 import StreamLog from './StreamLog.jsx';
@@ -37,6 +37,14 @@ function displayVersion({ currentVersion, tag, currentDigest }) {
   return shortDigest(currentDigest);
 }
 
+// Same release, different build? Compare versions ignoring a leading "v"
+// ("v1.2.3" and "1.2.3" are the same release).
+function sameVersion(a, b) {
+  if (!isMeaningfulVersion(a) || !isMeaningfulVersion(b)) return false;
+  const norm = (v) => v.trim().replace(/^v/i, '').toLowerCase();
+  return norm(a) === norm(b);
+}
+
 // Build a "Changelog"/"Source" link from the image's OCI source label. GitHub
 // repos get pointed at their releases page (best place for a changelog).
 function sourceLink(sourceUrl) {
@@ -139,7 +147,7 @@ function ChangelogContent({ data }) {
  *  - registerRunner(name, runFn) — handle for "Update all"
  */
 export default function UpdateCard({ container, onSettled, onPinChange, registerRunner }) {
-  const { name, project, service, image, currentDigest, availableVersion, availableDigest, updateAvailable, breakingRisk, pinned, sourceUrl, canRevert, rollbackVersion, checkError, state } =
+  const { name, project, service, image, currentDigest, availableVersion, availableDigest, updateAvailable, breakingRisk, skipped, pinned, sourceUrl, canRevert, rollbackVersion, checkError, state } =
     container;
 
   const [pinBusy, setPinBusy] = useState(false);
@@ -188,6 +196,25 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
     }
   }, [pinned, image, onPinChange]);
 
+  // Skip just the offered build (or undo that). Reuses the pin busy flag and
+  // refresh callback — both are "change what this card offers" actions.
+  const toggleSkip = useCallback(async () => {
+    setPinBusy(true);
+    setActionError('');
+    try {
+      if (skipped) {
+        await unskipUpdate(image);
+      } else {
+        await skipUpdate(image);
+      }
+      if (onPinChange) onPinChange();
+    } catch (err) {
+      setActionError(err.message || 'Failed to skip update');
+    } finally {
+      setPinBusy(false);
+    }
+  }, [skipped, image, onPinChange]);
+
   const toggleChangelog = useCallback(async () => {
     const next = !clOpen;
     setClOpen(next);
@@ -207,6 +234,11 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
 
   const showUpdateAvailable = updateAvailable && !pinned;
   const link = sourceLink(sourceUrl);
+  const runningLabel = displayVersion(container);
+  // The tag was re-published with a new image but the same version number —
+  // typically a base-image/security refresh. Say so, rather than showing a
+  // confusing "1.2.3 → 1.2.3".
+  const isRebuild = showUpdateAvailable && sameVersion(runningLabel, availableVersion);
 
   return (
     <div className={`update-card${showUpdateAvailable ? ' has-update' : ''}`}>
@@ -225,6 +257,11 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
               </span>
             )}
             {pinned && <span className="pill pill-pinned">Version pinned</span>}
+            {skipped && !pinned && (
+              <span className="pill" title={availableDigest || ''}>
+                Skipped {isMeaningfulVersion(availableVersion) ? availableVersion : 'update'}
+              </span>
+            )}
             {state && state !== 'running' && (
               <span className="pill pill-state" title={`Container is ${state} — updating it will start it`}>
                 {state}
@@ -249,14 +286,18 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
         <div className="version-row">
           <span className="version-label">Running</span>
           <span className="version-value" title={currentDigest || ''}>
-            {displayVersion(container)}
+            {runningLabel}
           </span>
         </div>
         {showUpdateAvailable && (
           <div className="version-row">
             <span className="version-label">Available</span>
             <span className="version-value is-available" title={availableDigest || ''}>
-              {isMeaningfulVersion(availableVersion) ? availableVersion : 'newer image'}
+              {isRebuild
+                ? `${availableVersion} (rebuilt)`
+                : isMeaningfulVersion(availableVersion)
+                  ? availableVersion
+                  : 'newer image'}
             </span>
             {breakingRisk && (
               <span className="breaking-flag" title="Release notes mention possible breaking changes">⚠️</span>
@@ -265,6 +306,13 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
         )}
       </div>
 
+      {isRebuild && (
+        <p className="card-hint">
+          Same version, new build ({shortDigest(currentDigest)} → {shortDigest(availableDigest)}). The
+          publisher re-pushed this tag — usually base-image or security patches.
+        </p>
+      )}
+
       {checkError && (
         <p className="card-check-error" title={checkError}>
           ⚠ Couldn't check for updates (e.g. private registry or rate limit).
@@ -287,6 +335,21 @@ export default function UpdateCard({ container, onSettled, onPinChange, register
               {clOpen ? 'Hide changes' : showUpdateAvailable ? "What's changed" : 'Release notes'}
             </button>
           )}
+          {(showUpdateAvailable || (skipped && !pinned)) && (
+            <button
+              type="button"
+              className="btn-ghost"
+              onClick={toggleSkip}
+              disabled={pinBusy || busy}
+              title={
+                skipped
+                  ? 'Offer this update again'
+                  : 'Hide this update until a newer one is released (unlike pinning, newer updates still show)'
+              }
+            >
+              {skipped ? 'Unskip' : 'Skip'}
+            </button>
+          )}
           {canRevert && (
             <button
               type="button"
diff --git a/client/src/hooks/useSSE.js b/client/src/hooks/useSSE.js
index 561e443..d03c51e 100644
--- a/client/src/hooks/useSSE.js
+++ b/client/src/hooks/useSSE.js
@@ -11,6 +11,8 @@ import { API_BASE } from '../api.js';
  * The stream is keyed by container name (not the streamId returned by
  * POST /api/update/:name — that value is informational only).
  */
+const RECONNECT_GRACE_MS = 30_000;
+
 export function useSSE(name, active) {
   const [lines, setLines] = useState([]);
   const [result, setResult] = useState(null);
@@ -34,9 +36,16 @@ export function useSSE(name, active) {
 
     const es = new EventSource(`${API_BASE}/update/${encodeURIComponent(name)}/stream`);
     esRef.current = es;
+    // Pending "give up reconnecting" timer while the browser retries.
+    let giveUp = null;
 
     es.onopen = () => {
+      clearTimeout(giveUp);
+      giveUp = null;
       setConnected(true);
+      // The server replays the whole buffered log to every (re)connection, so
+      // start fresh rather than duplicating what we already showed.
+      setLines([]);
     };
 
     es.onmessage = (event) => {
@@ -61,10 +70,23 @@ export function useSSE(name, active) {
 
     es.onerror = () => {
       setConnected(false);
-      setError('Connection lost');
+      // A blip (phone sleeping, proxy hiccup) is not a failed update: the
+      // browser reconnects on its own and the update keeps running server-side.
+      // Only report failure if the stream is closed for good, or stays down.
+      if (es.readyState === EventSource.CLOSED) {
+        setError('Connection lost');
+        return;
+      }
+      if (!giveUp) {
+        giveUp = setTimeout(() => {
+          es.close();
+          setError('Connection lost — the update may still be running. Refresh to check.');
+        }, RECONNECT_GRACE_MS);
+      }
     };
 
     return () => {
+      clearTimeout(giveUp);
       es.close();
       esRef.current = null;
     };
diff --git a/client/src/styles/app.css b/client/src/styles/app.css
index ca84267..2852a4b 100644
--- a/client/src/styles/app.css
+++ b/client/src/styles/app.css
@@ -1554,6 +1554,12 @@ a {
   color: var(--color-pending);
 }
 
+.card-hint {
+  margin: 8px 0 0;
+  font-size: 0.8rem;
+  color: var(--color-text-muted);
+}
+
 .about-version {
   color: var(--color-text-muted);
   font-weight: 400;
diff --git a/server/src/checker.js b/server/src/checker.js
index d8911f2..aba48d7 100644
--- a/server/src/checker.js
+++ b/server/src/checker.js
@@ -9,7 +9,7 @@
 
 import { listContainers } from './docker.js';
 import { getRemoteDigest, getRemoteVersion } from './registry.js';
-import { digestsEqual } from './reconcile.js';
+import { digestsEqual, isRunningDigest } from './reconcile.js';
 import { isMeaningfulVersion } from './version.js';
 import {
   parseGitHubRepo,
@@ -72,6 +72,9 @@ async function detectBreakingForContainer(c) {
     const gh = parseGitHubRepo(c.sourceUrl);
     if (!gh) return 0;
     const releases = await getReleasesCached(gh.owner, gh.repo);
+    // Without a known running version we can't tell which notes are "newer",
+    // and scanning the latest few releases wholesale over-flags.
+    if (!isMeaningfulVersion(c.currentVersion)) return 0;
     const newer = selectNewerReleases(releases, c.currentVersion);
     return detectBreakingChanges(newer) ? 1 : 0;
   } catch {
@@ -79,22 +82,47 @@ async function detectBreakingForContainer(c) {
   }
 }
 
+// The in-flight check, if any. A manual "Check for updates" and the daily scan
+// (or two open dashboards auto-checking) can overlap; running two checks at
+// once would race on the "already flagged?" lookup and insert duplicate events,
+// so concurrent callers share the one run instead.
+let inFlight = null;
+
 /**
  * @returns {Promise<{ total: number, checked: number, updatesFound: number, errors: number }>}
  * @throws if the Docker daemon can't be reached (caller maps to 503).
  */
-export async function runCheck() {
+export function runCheck() {
+  if (!inFlight) {
+    inFlight = doCheck().finally(() => {
+      inFlight = null;
+    });
+  }
+  return inFlight;
+}
+
+async function doCheck() {
   const containers = await listContainers();
 
-  // De-dupe by normalized ref so we hit each image once even if several
-  // containers run it.
+  // Group by normalized ref so we hit each registry tag once even if several
+  // containers run it — but keep every container, since they may be running
+  // different images of that tag (one recreated, another not). Containers with
+  // no registry digest (built locally, loaded from a tarball) have nothing to
+  // compare against, so they're counted as checked without a registry call.
   const byRef = new Map();
+  const noDigestRefs = new Set();
   for (const c of containers) {
-    if (!byRef.has(c.normalizedRef)) byRef.set(c.normalizedRef, c);
+    if (!c.currentDigest) {
+      noDigestRefs.add(c.normalizedRef);
+      continue;
+    }
+    if (!byRef.has(c.normalizedRef)) byRef.set(c.normalizedRef, []);
+    byRef.get(c.normalizedRef).push(c);
   }
   const items = [...byRef.values()];
+  const unverifiable = [...noDigestRefs].filter((ref) => !byRef.has(ref)).length;
 
-  let checked = 0;
+  let checked = unverifiable;
   let updatesFound = 0;
   let errors = 0;
   const errored = []; // { ref, image, message } per failed container check
@@ -102,14 +130,16 @@ export async function runCheck() {
   let idx = 0;
   async function worker() {
     while (idx < items.length) {
-      const c = items[idx];
+      const group = items[idx];
       idx += 1;
+      let c = group[0];
       try {
         const remote = await getRemoteDigest(c.image);
         checked += 1;
         if (!remote) continue; // digest-pinned or registry gave no digest
 
-        if (c.currentDigest && digestsEqual(remote, c.currentDigest)) {
+        const stale = group.filter((x) => !isRunningDigest(remote, x.currentDigest, x.currentDigests));
+        if (stale.length === 0) {
           // Up to date — clear any stale unresolved event.
           db.resolveEventsForRef(c.normalizedRef);
           // The running image IS the latest. If its own version label is junk
@@ -125,6 +155,7 @@ export async function runCheck() {
           }
           continue;
         }
+        c = stale[0];
 
         // Differs from what's running: flag it, unless we already have an
         // unresolved event for this exact digest (avoid duplicate rows on
@@ -146,7 +177,13 @@ export async function runCheck() {
 
         // Best-effort: only paid for images that actually have an update.
         const availableVersion = await resolveAvailableVersion(c);
-        const breaking = await detectBreakingForContainer(c);
+        // Scan release notes from what's actually running: prefer the image's
+        // own label, else a version remembered for its digest, so a junk label
+        // (`main`) doesn't make every recent release count as "newer".
+        const runningVersion = isMeaningfulVersion(c.currentVersion)
+          ? c.currentVersion
+          : db.getImageVersion(c.currentDigest);
+        const breaking = await detectBreakingForContainer({ ...c, currentVersion: runningVersion });
 
         db.recordEvent({
           image: c.image,
@@ -175,14 +212,15 @@ export async function runCheck() {
     Array.from({ length: Math.min(CONCURRENCY, items.length) }, () => worker())
   );
 
-  const summary = { at: Date.now(), total: items.length, checked, updatesFound, errors, errored };
+  const total = items.length + unverifiable;
+  const summary = { at: Date.now(), total, checked, updatesFound, errors, errored };
   try {
     db.setMeta('lastCheck', summary);
   } catch {
     // metadata persistence is best-effort; never fail a check over it.
   }
 
-  return { total: items.length, checked, updatesFound, errors };
+  return { total, checked, updatesFound, errors };
 }
 
 export default { runCheck };
diff --git a/server/src/containers-service.js b/server/src/containers-service.js
index 1d07aee..3268f24 100644
--- a/server/src/containers-service.js
+++ b/server/src/containers-service.js
@@ -9,7 +9,7 @@
  * server/test/containers-service.test.js).
  */
 
-import { isUpdateAvailable, digestsEqual } from './reconcile.js';
+import { isUpdateAvailable, isRunningDigest } from './reconcile.js';
 import { isMeaningfulVersion } from './version.js';
 
 /**
@@ -48,11 +48,13 @@ export function buildContainerItems({
     let updateAvailable;
     let availableDigest;
     let availableVersion;
+    let skipped = false;
 
-    if (event && digestsEqual(c.currentDigest, event.digest)) {
-      // The running container's digest already matches the event's digest:
-      // the update has already been applied. Mark the event resolved and
-      // report no update available.
+    if (event && isRunningDigest(event.digest, c.currentDigest, c.currentDigests)) {
+      // The running image is already known under the event's digest: the
+      // update has been applied (or the "new" digest was just a re-pushed
+      // index for the same image). Mark the event resolved and report no
+      // update available.
       refsToResolve.push(c.normalizedRef);
       updateAvailable = false;
       availableDigest = null;
@@ -61,6 +63,12 @@ export function buildContainerItems({
       updateAvailable = isUpdateAvailable(c.currentDigest, event?.digest);
       availableDigest = updateAvailable ? event.digest : null;
       availableVersion = updateAvailable ? (event?.available_version ?? null) : null;
+      // The user dismissed this exact build: not "available", but remember
+      // what was skipped so the card can offer to undo it.
+      if (updateAvailable && event?.skipped) {
+        skipped = true;
+        updateAvailable = false;
+      }
     }
 
     // Prefer the image's own meaningful version label; otherwise fall back to a
@@ -68,7 +76,7 @@ export function buildContainerItems({
     const currentVersion = isMeaningfulVersion(c.currentVersion)
       ? c.currentVersion
       : lookupVersion(c.currentDigest) ?? c.currentVersion ?? null;
-    if (updateAvailable && !isMeaningfulVersion(availableVersion)) {
+    if ((updateAvailable || skipped) && !isMeaningfulVersion(availableVersion)) {
       availableVersion = lookupVersion(availableDigest) ?? availableVersion ?? null;
     }
 
@@ -89,6 +97,7 @@ export function buildContainerItems({
       // Only meaningful alongside an actual update — a stale event's flag
       // must not leak through once the digests match again.
       breakingRisk: !!(updateAvailable && event?.breaking),
+      skipped,
       pinned: isPinned(c.normalizedRef),
       canRevert: !!rollback,
       rollbackVersion: rollback?.old_version ?? null,
diff --git a/server/src/db.js b/server/src/db.js
index 6e33c7a..fd07676 100644
--- a/server/src/db.js
+++ b/server/src/db.js
@@ -76,6 +76,11 @@ CREATE INDEX IF NOT EXISTS idx_history_created ON update_history(created_at DESC
   if (!cols.includes('breaking')) {
     db.exec('ALTER TABLE update_events ADD COLUMN breaking INTEGER DEFAULT 0');
   }
+  // `skipped`: the user dismissed this specific available build ("Skip this
+  // update"). A newer build creates a fresh, unskipped event.
+  if (!cols.includes('skipped')) {
+    db.exec('ALTER TABLE update_events ADD COLUMN skipped INTEGER DEFAULT 0');
+  }
 }
 
 const stmts = {
@@ -92,6 +97,14 @@ const stmts = {
     UPDATE update_events SET resolved = 1
     WHERE normalized_ref = ? AND resolved = 0
   `),
+  setLatestEventSkipped: db.prepare(`
+    UPDATE update_events SET skipped = ?
+    WHERE id = (
+      SELECT id FROM update_events
+      WHERE normalized_ref = ? AND resolved = 0
+      ORDER BY id DESC LIMIT 1
+    )
+  `),
   updateEventAvailableVersion: db.prepare(`
     UPDATE update_events SET available_version = ?
     WHERE normalized_ref = ? AND digest = ? AND resolved = 0
@@ -199,6 +212,14 @@ export function resolveEventsForRef(normalized_ref) {
   return stmts.resolveEventsForRef.run(normalized_ref);
 }
 
+/**
+ * Skip (or un-skip) the currently offered update for a ref — i.e. its latest
+ * unresolved event. Returns true if there was one to change.
+ */
+export function setLatestEventSkipped(normalized_ref, skipped) {
+  return stmts.setLatestEventSkipped.run(skipped ? 1 : 0, normalized_ref).changes > 0;
+}
+
 export function updateEventAvailableVersion(normalized_ref, digest, available_version) {
   return stmts.updateEventAvailableVersion.run(available_version ?? null, normalized_ref, digest);
 }
diff --git a/server/src/docker.js b/server/src/docker.js
index 50b2edc..56b415c 100644
--- a/server/src/docker.js
+++ b/server/src/docker.js
@@ -56,60 +56,61 @@ function stripLeadingSlash(rawName) {
 }
 
 /**
- * Pure: picks the digest from an image's `RepoDigests` that matches the
- * configured image ref's repo, to disambiguate when an image was pulled/
- * tagged under several refs. Falls back to the sole RepoDigest if there's
- * exactly one. Returns null when there's no usable match.
+ * Pure: every digest in an image's `RepoDigests` that belongs to the
+ * configured image ref's repo. An image can legitimately carry several digests
+ * for the same repo — e.g. it was pulled under two tags whose manifest lists
+ * differ only in annotations, or the publisher re-pushed the tag's index
+ * (adding attestations) without changing the image itself. Docker lists them
+ * in lexical order, not newest-first, so any one of them may be the digest the
+ * registry currently serves; callers must compare against all of them. Falls
+ * back to the sole RepoDigest if there's exactly one and no repo match.
  *
  * @param {string[]|undefined} repoDigests - image inspect `RepoDigests`.
  * @param {string} image - configured image ref, e.g. "nginx:latest".
- * @returns {string|null}
+ * @returns {string[]}
  */
-function pickRepoDigest(repoDigests, image) {
+export function pickRepoDigests(repoDigests, image) {
   if (!Array.isArray(repoDigests) || repoDigests.length === 0) {
-    return null;
+    return [];
   }
 
   // Determine the repo (registry/repo, no tag) we're looking for.
   let wantedRepo = null;
   try {
-    const normalized = normalizeRef(image);
-    wantedRepo = normalized.includes(':')
-      ? normalized.slice(0, normalized.lastIndexOf(':'))
-      : normalized;
+    const { registry, repository } = parseRef(image);
+    wantedRepo = `${registry}/${repository}`;
   } catch {
     wantedRepo = null;
   }
 
+  const matches = [];
   if (wantedRepo) {
     for (const entry of repoDigests) {
       const atIdx = entry.lastIndexOf('@');
       if (atIdx === -1) continue;
-      const repoPart = entry.slice(0, atIdx);
-      let normalizedRepoPart;
+      let entryRepo;
       try {
-        // Append a dummy tag so normalizeRef parses repoPart as a name,
-        // not as "repo:port"-style ambiguity; we only need the
-        // registry/repo portion back out.
-        const probe = normalizeRef(`${repoPart}:__probe__`);
-        normalizedRepoPart = probe.slice(0, probe.lastIndexOf(':'));
+        const { registry, repository } = parseRef(entry);
+        entryRepo = `${registry}/${repository}`;
       } catch {
-        normalizedRepoPart = repoPart;
+        entryRepo = entry.slice(0, atIdx);
       }
-      if (normalizedRepoPart === wantedRepo) {
-        return entry.slice(atIdx + 1);
+      const digest = entry.slice(atIdx + 1);
+      if (entryRepo === wantedRepo && !matches.includes(digest)) {
+        matches.push(digest);
       }
     }
   }
+  if (matches.length > 0) return matches;
 
   // No repo match found; fall back to the sole RepoDigest's digest part, but
   // only if there's exactly one (otherwise it's ambiguous which applies).
   if (repoDigests.length === 1) {
     const atIdx = repoDigests[0].lastIndexOf('@');
-    return atIdx === -1 ? null : repoDigests[0].slice(atIdx + 1);
+    return atIdx === -1 ? [] : [repoDigests[0].slice(atIdx + 1)];
   }
 
-  return null;
+  return [];
 }
 
 /**
@@ -120,7 +121,7 @@ function pickRepoDigest(repoDigests, image) {
  *
  * @param {string} imageIdOrName - `Image` field from container inspect.
  * @param {string} image - configured image ref, e.g. "nginx:latest".
- * @returns {Promise<{ digest: string|null, version: string|null }>}
+ * @returns {Promise<{ digest: string|null, digests: string[], version: string|null, source: string|null }>}
  */
 async function inspectImageMeta(imageIdOrName, image) {
   let imageInfo;
@@ -128,7 +129,7 @@ async function inspectImageMeta(imageIdOrName, image) {
     imageInfo = await docker.getImage(imageIdOrName).inspect();
   } catch (err) {
     console.warn(`docker.js: failed to inspect image ${imageIdOrName}: ${err.message}`);
-    return { digest: null, version: null };
+    return { digest: null, digests: [], version: null, source: null };
   }
 
   const labels = imageInfo?.Config?.Labels || {};
@@ -136,8 +137,8 @@ async function inspectImageMeta(imageIdOrName, image) {
   const source = normalizeSourceUrl(
     labels['org.opencontainers.image.source'] || labels['org.opencontainers.image.url'] || null
   );
-  const digest = pickRepoDigest(imageInfo?.RepoDigests, image);
-  return { digest, version, source };
+  const digests = pickRepoDigests(imageInfo?.RepoDigests, image);
+  return { digest: digests[0] ?? null, digests, version, source };
 }
 
 /**
@@ -311,6 +312,7 @@ export async function listContainers() {
 
       const {
         digest: currentDigest,
+        digests: currentDigests,
         version: currentVersion,
         source: sourceUrl,
       } = await inspectImageMeta(inspectData.Image, image);
@@ -351,6 +353,7 @@ export async function listContainers() {
         currentVersion,
         sourceUrl: sourceUrl || null,
         currentDigest,
+        currentDigests,
         project: project || null,
         service: service || null,
         composeFile: composeFile || null,
@@ -450,6 +453,181 @@ async function currentDigestForContainerName(name) {
   return resolveCurrentDigest(inspectData.Image, image);
 }
 
+/**
+ * True when two JSON-ish values are structurally equal (arrays/objects/
+ * primitives, as Docker inspect returns them). null and undefined are equal.
+ */
+function sameValue(a, b) {
+  if (a == null && b == null) return true;
+  return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+}
+
+/**
+ * Pure: container create options that recreate `inspectData`'s container from
+ * `targetImage`, keeping only what the user configured and letting the target
+ * image supply its own defaults.
+ *
+ * A container's inspected Config is the *merge* of the old image's defaults and
+ * the user's overrides. Copying it verbatim onto a new image would pin the old
+ * image's ENV (e.g. APP_VERSION, PATH), CMD/ENTRYPOINT, labels and volumes
+ * over the new image's — so anything identical to `baseImageConfig` (the image
+ * the container currently runs) is dropped and left to the target image.
+ * Also carries anonymous volumes over by name (their data would otherwise be
+ * orphaned) and keeps a user-set hostname.
+ *
+ * @param {object} inspectData - container inspect output.
+ * @param {object|null} baseImageConfig - `Config` of the image it runs now.
+ * @param {string} targetImage - image ref/ID to create from.
+ * @returns {object} options for `docker.createContainer` (without `name`).
+ */
+export function buildRecreateOptions(inspectData, baseImageConfig, targetImage) {
+  const cfg = inspectData.Config || {};
+  const base = baseImageConfig || {};
+  const unlessDefault = (key) => (sameValue(cfg[key], base[key]) ? undefined : cfg[key]);
+
+  const baseEnv = new Set(base.Env || []);
+  const env = (cfg.Env || []).filter((e) => !baseEnv.has(e));
+
+  const baseLabels = base.Labels || {};
+  const labels = {};
+  for (const [k, v] of Object.entries(cfg.Labels || {})) {
+    if (baseLabels[k] !== v) labels[k] = v;
+  }
+
+  const minusBase = (obj, baseObj) => {
+    const out = {};
+    for (const k of Object.keys(obj || {})) {
+      if (!baseObj || !(k in baseObj)) out[k] = obj[k];
+    }
+    return Object.keys(out).length ? out : undefined;
+  };
+
+  // Docker's default hostname is the short container ID; only a hostname the
+  // user set (`hostname:` / --hostname) should survive into the new container.
+  const defaultHostname = (inspectData.Id || '').slice(0, 12);
+  const hostname = cfg.Hostname && cfg.Hostname !== defaultHostname ? cfg.Hostname : undefined;
+
+  // Re-attach anonymous volumes (64-hex names) by name so their data follows
+  // the container. Skip destinations the user already mounts explicitly.
+  const hostConfig = { ...(inspectData.HostConfig || {}) };
+  const covered = new Set([
+    ...(hostConfig.Binds || []).map((b) => b.split(':')[1]).filter(Boolean),
+    ...(hostConfig.Mounts || []).map((m) => m.Target).filter(Boolean),
+  ]);
+  const anonBinds = (inspectData.Mounts || [])
+    .filter((m) => m.Type === 'volume' && /^[0-9a-f]{64}$/.test(m.Name || '') && !covered.has(m.Destination))
+    .map((m) => `${m.Name}:${m.Destination}${m.RW === false ? ':ro' : ''}`);
+  if (anonBinds.length) hostConfig.Binds = [...(hostConfig.Binds || []), ...anonBinds];
+
+  // Keep only the user-meaningful endpoint settings; runtime state (IPs,
+  // endpoint/network IDs, the old container's ID alias) must not be replayed.
+  const shortId = defaultHostname;
+  const endpoints = {};
+  for (const [net, ep] of Object.entries(inspectData.NetworkSettings?.Networks || {})) {
+    const aliases = (ep?.Aliases || []).filter((a) => a !== shortId);
+    endpoints[net] = {
+      ...(ep?.IPAMConfig ? { IPAMConfig: ep.IPAMConfig } : {}),
+      ...(ep?.Links ? { Links: ep.Links } : {}),
+      ...(aliases.length ? { Aliases: aliases } : {}),
+      ...(ep?.DriverOpts ? { DriverOpts: ep.DriverOpts } : {}),
+    };
+  }
+
+  const opts = {
+    Image: targetImage,
+    Hostname: hostname,
+    Domainname: cfg.Domainname || undefined,
+    Cmd: unlessDefault('Cmd'),
+    Entrypoint: unlessDefault('Entrypoint'),
+    Env: env,
+    Labels: labels,
+    ExposedPorts: minusBase(cfg.ExposedPorts, base.ExposedPorts),
+    Volumes: minusBase(cfg.Volumes, base.Volumes),
+    WorkingDir: unlessDefault('WorkingDir'),
+    User: unlessDefault('User'),
+    Healthcheck: unlessDefault('Healthcheck'),
+    StopSignal: unlessDefault('StopSignal'),
+    StopTimeout: cfg.StopTimeout,
+    Tty: cfg.Tty,
+    OpenStdin: cfg.OpenStdin,
+    HostConfig: hostConfig,
+    NetworkingConfig: { EndpointsConfig: endpoints },
+  };
+  for (const k of Object.keys(opts)) if (opts[k] === undefined) delete opts[k];
+  return opts;
+}
+
+async function imageConfigOf(imageId) {
+  try {
+    return (await docker.getImage(imageId).inspect())?.Config || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Replace a container with a new one built from `createOpts`, without ever
+ * leaving the user with nothing: the old container is stopped and renamed out
+ * of the way (not removed) until the new one has been created and started. On
+ * any failure the new container is discarded and the old one is renamed back
+ * and restarted. The old one is only removed once the new one is running.
+ *
+ * @param {{ start?: boolean }} [opts] - start the new container (defaults to
+ *   whether the old one was running).
+ * @returns {Promise<void>} throws (after rolling back) if the swap failed.
+ */
+async function replaceContainer(name, inspectData, createOpts, log, opts = {}) {
+  const old = docker.getContainer(inspectData.Id);
+  const wasRunning = inspectData.State?.Running === true;
+  const start = opts.start ?? wasRunning;
+  const backupName = `${name}-dockpull-old-${Date.now()}`;
+
+  if (wasRunning) {
+    try {
+      await old.stop();
+    } catch (err) {
+      if (err.statusCode !== 304) throw err; // 304: already stopped
+    }
+  }
+
+  // Rename the old container out of the way. An --rm (AutoRemove) container
+  // is already gone once stopped — then there's nothing to fall back to.
+  let backedUp = false;
+  try {
+    await old.rename({ name: backupName });
+    backedUp = true;
+  } catch (err) {
+    if (err.statusCode !== 404) throw err;
+  }
+
+  let created = null;
+  try {
+    created = await docker.createContainer({ name, ...createOpts });
+    if (start) await created.start();
+  } catch (err) {
+    if (backedUp) {
+      log?.(`Recreate failed (${err.message}); restoring the previous container…`);
+      try {
+        if (created) await created.remove({ force: true });
+        await old.rename({ name });
+        if (wasRunning) await old.start();
+        log?.('Previous container restored.');
+      } catch (restoreErr) {
+        log?.(`Could not restore the previous container (kept as "${backupName}"): ${restoreErr.message}`);
+      }
+    }
+    throw err;
+  }
+
+  if (backedUp) {
+    try {
+      await old.remove();
+    } catch (err) {
+      console.warn(`docker.js: couldn't remove old container ${backupName}: ${err.message}`);
+    }
+  }
+}
+
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
 /**
@@ -661,40 +839,11 @@ export async function updateContainer(name, onLine) {
     };
   }
 
+  const wasRunning = inspectData.State?.Running === true;
   try {
-    const container = docker.getContainer(name);
-
-    const wasRunning = inspectData.State?.Running === true;
-
-    if (wasRunning) {
-      await container.stop();
-    }
-    await container.remove();
-
-    const created = await docker.createContainer({
-      name,
-      Image: inspectData.Config.Image,
-      Cmd: inspectData.Config.Cmd,
-      Entrypoint: inspectData.Config.Entrypoint,
-      Env: inspectData.Config.Env,
-      Labels: inspectData.Config.Labels,
-      ExposedPorts: inspectData.Config.ExposedPorts,
-      Volumes: inspectData.Config.Volumes,
-      WorkingDir: inspectData.Config.WorkingDir,
-      User: inspectData.Config.User,
-      Tty: inspectData.Config.Tty,
-      OpenStdin: inspectData.Config.OpenStdin,
-      StopSignal: inspectData.Config.StopSignal,
-      StopTimeout: inspectData.Config.StopTimeout,
-      HostConfig: inspectData.HostConfig,
-      NetworkingConfig: {
-        EndpointsConfig: inspectData.NetworkSettings?.Networks,
-      },
-    });
-
-    if (wasRunning) {
-      await created.start();
-    }
+    const baseImageConfig = await imageConfigOf(inspectData.Image);
+    const createOpts = buildRecreateOptions(inspectData, baseImageConfig, image);
+    await replaceContainer(name, inspectData, createOpts, (l) => onLine?.(l, 'stdout'));
   } catch (err) {
     return {
       success: false,
@@ -741,33 +890,13 @@ export async function revertContainer(name, imageId, onLine) {
   }
 
   const oldDigest = await currentDigestForContainerName(name);
-  const wasRunning = inspectData.State?.Running === true;
 
   try {
     log(`Reverting "${name}" to the previous image…`);
-    const container = docker.getContainer(name);
-    if (wasRunning) await container.stop();
-    await container.remove();
-
-    const created = await docker.createContainer({
-      name,
-      Image: imageId,
-      Cmd: inspectData.Config.Cmd,
-      Entrypoint: inspectData.Config.Entrypoint,
-      Env: inspectData.Config.Env,
-      Labels: inspectData.Config.Labels,
-      ExposedPorts: inspectData.Config.ExposedPorts,
-      Volumes: inspectData.Config.Volumes,
-      WorkingDir: inspectData.Config.WorkingDir,
-      User: inspectData.Config.User,
-      Tty: inspectData.Config.Tty,
-      OpenStdin: inspectData.Config.OpenStdin,
-      StopSignal: inspectData.Config.StopSignal,
-      StopTimeout: inspectData.Config.StopTimeout,
-      HostConfig: inspectData.HostConfig,
-      NetworkingConfig: { EndpointsConfig: inspectData.NetworkSettings?.Networks },
-    });
-    await created.start();
+    const baseImageConfig = await imageConfigOf(inspectData.Image);
+    const createOpts = buildRecreateOptions(inspectData, baseImageConfig, imageId);
+    // Revert always starts the container, even if it was stopped.
+    await replaceContainer(name, inspectData, createOpts, log, { start: true });
     log('Container recreated from the previous image.');
   } catch (err) {
     return { success: false, message: `Failed to revert container: ${err.message}`, oldDigest, newDigest: null };
diff --git a/server/src/notify.js b/server/src/notify.js
index f92af92..1d2dc4c 100644
--- a/server/src/notify.js
+++ b/server/src/notify.js
@@ -16,11 +16,21 @@ const MAX_LISTED = 25; // keep messages from blowing past provider limits
 
 export const NOTIFY_TYPES = ['discord', 'ntfy', 'gotify', 'webhook'];
 
+// "(1.2.3 → 1.2.4)", "(current: 1.2.3)", or "" — whatever versions we know.
+function versionSuffix(i) {
+  const cur = i.currentVersion || null;
+  const avail = i.availableVersion || null;
+  if (cur && avail && cur !== avail) return ` (${cur} → ${avail})`;
+  if (cur && avail) return ` (${cur}, rebuilt)`;
+  if (avail) return ` (→ ${avail})`;
+  if (cur) return ` (current: ${cur})`;
+  return '';
+}
+
 function summaryLines(items) {
   return items.slice(0, MAX_LISTED).map((i) => {
-    const ver = i.currentVersion ? ` (current: ${i.currentVersion})` : '';
     const warn = i.breakingRisk ? '⚠️ ' : '';
-    return `• ${warn}${i.name} — ${i.image}${ver}`;
+    return `• ${warn}${i.name} — ${i.image}${versionSuffix(i)}`;
   });
 }
 
@@ -41,9 +51,8 @@ function title(items) {
 export function buildDiscordPayload(items) {
   const header = `🔔 **${title(items)}**`;
   const lines = items.slice(0, MAX_LISTED).map((i) => {
-    const ver = i.currentVersion ? ` (current: ${i.currentVersion})` : '';
     const warn = i.breakingRisk ? '⚠️ ' : '';
-    return `• ${warn}**${i.name}** — \`${i.image}\`${ver}`;
+    return `• ${warn}**${i.name}** — \`${i.image}\`${versionSuffix(i)}`;
   });
   return { content: [header, ...lines, ...moreLine(items)].join('\n') };
 }
@@ -100,12 +109,26 @@ async function postJson(url, payload, { timeoutMs = 10000 } = {}) {
   return { ok: res.ok, status: res.status };
 }
 
-async function postText(url, body, headers = {}, { timeoutMs = 10000 } = {}) {
+/**
+ * ntfy target URL carrying the title/tags as query parameters. ntfy accepts
+ * them either as headers or as `?title=&tags=`; headers can't be used here
+ * because fetch only allows Latin-1 header values and our titles contain
+ * emoji (a `Title: 🔔 …` header throws before the request is even sent).
+ * Query params are percent-encoded UTF-8, so they're always safe.
+ */
+export function buildNtfyUrl(url, { title: t, tags } = {}) {
+  const u = new URL(url.trim());
+  if (t) u.searchParams.set('title', t);
+  if (tags) u.searchParams.set('tags', tags);
+  return u.toString();
+}
+
+async function postNtfy(url, message, { timeoutMs = 10000 } = {}) {
   assertValidUrl(url);
-  const res = await fetch(url, {
+  const res = await fetch(buildNtfyUrl(url, message), {
     method: 'POST',
-    headers: { 'Content-Type': 'text/plain; charset=utf-8', ...headers },
-    body,
+    headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+    body: message.body,
     signal: AbortSignal.timeout(timeoutMs),
   });
   return { ok: res.ok, status: res.status };
@@ -117,10 +140,8 @@ async function postText(url, body, headers = {}, { timeoutMs = 10000 } = {}) {
  */
 export function sendUpdates(type, url, items, opts) {
   switch (type) {
-    case 'ntfy': {
-      const m = buildNtfyMessage(items);
-      return postText(url, m.body, { Title: m.title, Tags: m.tags }, opts);
-    }
+    case 'ntfy':
+      return postNtfy(url, buildNtfyMessage(items), opts);
     case 'gotify':
       return postJson(url, buildGotifyPayload(items), opts);
     case 'webhook':
@@ -136,7 +157,9 @@ export function sendTest(type, url, opts) {
   const text = '✅ DockPull test — your notifications are configured correctly.';
   switch (type) {
     case 'ntfy':
-      return postText(url, text, { Title: 'DockPull test', Tags: 'white_check_mark' }, opts);
+      // Same emoji-bearing title style as real notifications, so a passing
+      // test really proves real notifications will get through.
+      return postNtfy(url, { title: '✅ DockPull test', tags: 'white_check_mark', body: text }, opts);
     case 'gotify':
       return postJson(url, { title: 'DockPull test', message: text, priority: 5 }, opts);
     case 'webhook':
@@ -151,6 +174,7 @@ export default {
   NOTIFY_TYPES,
   buildDiscordPayload,
   buildNtfyMessage,
+  buildNtfyUrl,
   buildGotifyPayload,
   buildWebhookPayload,
   sendUpdates,
diff --git a/server/src/reconcile.js b/server/src/reconcile.js
index 97531f2..e1ae4d6 100644
--- a/server/src/reconcile.js
+++ b/server/src/reconcile.js
@@ -151,6 +151,22 @@ export function digestsEqual(a, b) {
   return na === nb;
 }
 
+/**
+ * True if `digest` equals the primary `currentDigest` or any of the image's
+ * other repo digests (see docker.js pickRepoDigests — one local image can be
+ * known under several registry digests, and any of them means "this exact
+ * image is what's running").
+ *
+ * @param {string|null|undefined} digest
+ * @param {string|null|undefined} currentDigest
+ * @param {Array<string>|null|undefined} [currentDigests]
+ * @returns {boolean}
+ */
+export function isRunningDigest(digest, currentDigest, currentDigests) {
+  if (digestsEqual(digest, currentDigest)) return true;
+  return Array.isArray(currentDigests) && currentDigests.some((d) => digestsEqual(digest, d));
+}
+
 /**
  * @param {string|null|undefined} digest
  * @returns {string|null} trimmed, lowercased `sha256:...` string, or null
diff --git a/server/src/routes/api.js b/server/src/routes/api.js
index b006a61..7294018 100644
--- a/server/src/routes/api.js
+++ b/server/src/routes/api.js
@@ -241,6 +241,38 @@ apiRouter.delete('/api/pin/:ref', (req, res) => {
   return res.status(200).json({ ok: true });
 });
 
+// Skip the currently offered update for an image ("not this build") without
+// pinning it: the card and notifications stay quiet until a newer build
+// appears. `DELETE` undoes it.
+function setSkipped(rawRef, skipped, res) {
+  if (typeof rawRef !== 'string' || rawRef.trim() === '') {
+    return res.status(400).json({ error: 'invalid_payload' });
+  }
+  let normalized;
+  try {
+    normalized = normalizeRef(rawRef);
+  } catch {
+    return res.status(400).json({ error: 'invalid_payload' });
+  }
+  if (!db.setLatestEventSkipped(normalized, skipped)) {
+    return res.status(404).json({ error: 'no_pending_update' });
+  }
+  broadcastGlobal({ type: 'containers-changed' });
+  return res.status(200).json({ ok: true });
+}
+
+apiRouter.post('/api/skip', (req, res) => setSkipped(req.body?.ref, true, res));
+
+apiRouter.delete('/api/skip/:ref', (req, res) => {
+  let ref;
+  try {
+    ref = decodeURIComponent(req.params.ref);
+  } catch {
+    return res.status(400).json({ error: 'invalid_payload' });
+  }
+  return setSkipped(ref, false, res);
+});
+
 // --- Settings ---
 
 apiRouter.get('/api/settings', (req, res) => {
diff --git a/server/src/scheduler.js b/server/src/scheduler.js
index 3589fae..86a3e6d 100644
--- a/server/src/scheduler.js
+++ b/server/src/scheduler.js
@@ -15,6 +15,7 @@ import { listContainers, listDanglingImages } from './docker.js';
 import { buildContainerItems } from './containers-service.js';
 import { normalizeRef } from './reconcile.js';
 import { sendUpdates } from './notify.js';
+import { broadcastGlobal } from './sse.js';
 import * as db from './db.js';
 
 let timer = null;
@@ -68,6 +69,8 @@ export function selectNotifyTargets(items, unnotifiedRefs, normalizeRefFn) {
  */
 export async function runScheduledCheck() {
   await runCheck();
+  // Let any open dashboards pick up what the scan found.
+  broadcastGlobal({ type: 'containers-changed' });
 
   // Best-effort: note whether there's anything to prune, so the client can
   // show a badge without hitting the Docker API on every page load. Never
@@ -96,6 +99,9 @@ export async function runScheduledCheck() {
     containers,
     lookupEvent: db.latestUnresolvedEventForRef,
     isPinned: (ref) => db.isPinned(ref),
+    // Same remembered versions the dashboard shows, so the message reads
+    // "1.2.3 → 1.2.4" rather than a junk label like "main".
+    lookupVersion: (digest) => db.getImageVersion(digest),
   });
 
   const { toNotify, hasNew } = selectNotifyTargets(items, unnotified, normalizeRef);
diff --git a/server/src/sse.js b/server/src/sse.js
index 5121b91..c8b637d 100644
--- a/server/src/sse.js
+++ b/server/src/sse.js
@@ -40,6 +40,13 @@ export function startSession(name) {
     return false;
   }
 
+  // A just-finished session for this name may still be in its grace period;
+  // cancel its cleanup timer, or it would fire mid-way through the NEW session
+  // (e.g. a Revert started right after a failed update) and delete it —
+  // silently dropping its logs and result.
+  const previous = sessions.get(name);
+  if (previous?.timer) clearTimeout(previous.timer);
+
   const session = {
     lines: [],
     result: null,
@@ -98,8 +105,10 @@ export function finish(name, result) {
   session.subscribers.clear();
 
   session.timer = setTimeout(() => {
-    sessions.delete(name);
+    // Only remove this session — never a newer one started under the same name.
+    if (sessions.get(name) === session) sessions.delete(name);
   }, FINISHED_SESSION_TTL_MS);
+  session.timer.unref?.();
 }
 
 /**
diff --git a/server/test/containers-service.test.js b/server/test/containers-service.test.js
index 49619b0..ce45617 100644
--- a/server/test/containers-service.test.js
+++ b/server/test/containers-service.test.js
@@ -158,6 +158,7 @@ describe('buildContainerItems', () => {
       availableDigest: null,
       availableVersion: null,
       breakingRisk: false,
+      skipped: false,
       pinned: false,
       canRevert: false,
       rollbackVersion: null,
@@ -207,3 +208,34 @@ describe('buildContainerItems', () => {
     assert.deepEqual(refsToResolve, ['docker.io/library/b:latest']);
   });
 });
+
+describe('buildContainerItems: image known under several repo digests', () => {
+  // Regression for "says there's an update but it's the same version": the
+  // running image has two RepoDigests for its repo (e.g. the publisher
+  // re-pushed the tag's index). The registry's current digest is the second
+  // one — that's the SAME image, not an update.
+  test('event digest matching any of the running repo digests -> no update, event resolved', () => {
+    const containers = [
+      makeContainer({ currentDigest: 'sha256:aaa', currentDigests: ['sha256:aaa', 'sha256:bbb'] }),
+    ];
+    const { items, refsToResolve } = buildContainerItems({
+      containers,
+      lookupEvent: () => ({ digest: 'sha256:bbb', available_version: '1.0.0' }),
+      isPinned: () => false,
+    });
+    assert.equal(items[0].updateAvailable, false);
+    assert.deepEqual(refsToResolve, ['docker.io/library/nginx:latest']);
+  });
+
+  test('a genuinely different digest is still an update', () => {
+    const containers = [
+      makeContainer({ currentDigest: 'sha256:aaa', currentDigests: ['sha256:aaa', 'sha256:bbb'] }),
+    ];
+    const { items } = buildContainerItems({
+      containers,
+      lookupEvent: () => ({ digest: 'sha256:ccc' }),
+      isPinned: () => false,
+    });
+    assert.equal(items[0].updateAvailable, true);
+  });
+});
diff --git a/server/test/db-skip.test.js b/server/test/db-skip.test.js
new file mode 100644
index 0000000..eac2b1e
--- /dev/null
+++ b/server/test/db-skip.test.js
@@ -0,0 +1,52 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// Point DATA_DIR at a throwaway dir BEFORE importing db.
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'dockpull-skip-'));
+process.env.DATA_DIR = tmp;
+
+const db = await import('../src/db.js');
+const { buildContainerItems } = await import('../src/containers-service.js');
+
+const REF = 'docker.io/library/nginx:latest';
+const container = {
+  name: 'nginx',
+  image: 'nginx:latest',
+  currentDigest: 'sha256:aaa',
+  normalizedRef: REF,
+  state: 'running',
+};
+const items = () =>
+  buildContainerItems({
+    containers: [container],
+    lookupEvent: db.latestUnresolvedEventForRef,
+    isPinned: () => false,
+  }).items;
+
+test('skip hides the offered build; a newer build shows up again; unskip restores', () => {
+  db.recordEvent({ image: 'nginx:latest', normalized_ref: REF, status: 'update', digest: 'sha256:bbb', available_version: '1.1' });
+  assert.equal(items()[0].updateAvailable, true);
+
+  assert.equal(db.setLatestEventSkipped(REF, true), true);
+  let [it] = items();
+  assert.equal(it.updateAvailable, false);
+  assert.equal(it.skipped, true);
+  assert.equal(it.availableVersion, '1.1');
+
+  assert.equal(db.setLatestEventSkipped(REF, false), true);
+  assert.equal(items()[0].updateAvailable, true);
+
+  db.setLatestEventSkipped(REF, true);
+  db.recordEvent({ image: 'nginx:latest', normalized_ref: REF, status: 'update', digest: 'sha256:ccc' });
+  [it] = items();
+  assert.equal(it.updateAvailable, true);
+  assert.equal(it.skipped, false);
+  assert.equal(it.availableDigest, 'sha256:ccc');
+});
+
+test('skip with no pending update reports nothing changed', () => {
+  assert.equal(db.setLatestEventSkipped('docker.io/library/none:latest', true), false);
+});
diff --git a/server/test/docker.test.js b/server/test/docker.test.js
index 4556dae..361c84a 100644
--- a/server/test/docker.test.js
+++ b/server/test/docker.test.js
@@ -18,3 +18,117 @@ test('shortImageId: empty / missing input returns an empty string', () => {
   assert.equal(shortImageId(null), '');
   assert.equal(shortImageId(undefined), '');
 });
+
+import { pickRepoDigests } from '../src/docker.js';
+
+test('pickRepoDigests: returns every digest for the configured repo, in order', () => {
+  const repoDigests = [
+    'nginx@sha256:111',
+    'ghcr.io/other/nginx@sha256:222',
+    'docker.io/library/nginx@sha256:333',
+  ];
+  assert.deepEqual(pickRepoDigests(repoDigests, 'nginx:latest'), ['sha256:111', 'sha256:333']);
+});
+
+test('pickRepoDigests: normalizes Hub namespaces and registries', () => {
+  assert.deepEqual(
+    pickRepoDigests(['linuxserver/sonarr@sha256:aaa'], 'docker.io/linuxserver/sonarr:latest'),
+    ['sha256:aaa']
+  );
+  assert.deepEqual(
+    pickRepoDigests(['registry:5000/team/app@sha256:bbb'], 'registry:5000/team/app:1.2'),
+    ['sha256:bbb']
+  );
+});
+
+test('pickRepoDigests: sole unrelated digest is used as a fallback; several are ambiguous', () => {
+  assert.deepEqual(pickRepoDigests(['mirror.local/x@sha256:aaa'], 'nginx:latest'), ['sha256:aaa']);
+  assert.deepEqual(
+    pickRepoDigests(['mirror.local/x@sha256:aaa', 'mirror.local/y@sha256:bbb'], 'nginx:latest'),
+    []
+  );
+  assert.deepEqual(pickRepoDigests(undefined, 'nginx:latest'), []);
+  assert.deepEqual(pickRepoDigests([], 'nginx:latest'), []);
+});
+
+import { buildRecreateOptions } from '../src/docker.js';
+
+const ID = 'abcdef1234567890'.padEnd(64, '0');
+const baseImage = {
+  Env: ['PATH=/usr/bin', 'APP_VERSION=1.0'],
+  Cmd: ['serve'],
+  Entrypoint: ['/entry'],
+  Labels: { 'org.opencontainers.image.version': '1.0' },
+  ExposedPorts: { '80/tcp': {} },
+  Volumes: { '/data': {} },
+  WorkingDir: '/app',
+  User: '',
+};
+const inspect = {
+  Id: ID,
+  Config: {
+    Hostname: ID.slice(0, 12),
+    Image: 'app:latest',
+    Env: ['PATH=/usr/bin', 'APP_VERSION=1.0', 'TZ=Europe/London'],
+    Cmd: ['serve'],
+    Entrypoint: ['/entry'],
+    Labels: { 'org.opencontainers.image.version': '1.0', 'my.label': 'x' },
+    ExposedPorts: { '80/tcp': {}, '9000/tcp': {} },
+    Volumes: { '/data': {} },
+    WorkingDir: '/app',
+    User: '',
+  },
+  HostConfig: { Binds: ['/srv/conf:/conf:ro'], RestartPolicy: { Name: 'unless-stopped' } },
+  Mounts: [
+    { Type: 'bind', Source: '/srv/conf', Destination: '/conf' },
+    { Type: 'volume', Name: 'f'.repeat(64), Destination: '/data', RW: true },
+  ],
+  NetworkSettings: {
+    Networks: {
+      web: { Aliases: ['app', ID.slice(0, 12)], IPAddress: '172.18.0.5', NetworkID: 'n1', EndpointID: 'e1' },
+    },
+  },
+};
+
+test('buildRecreateOptions: drops the old image defaults, keeps user overrides', () => {
+  const o = buildRecreateOptions(inspect, baseImage, 'app:latest');
+  assert.equal(o.Image, 'app:latest');
+  assert.deepEqual(o.Env, ['TZ=Europe/London']); // new image supplies PATH/APP_VERSION
+  assert.equal(o.Cmd, undefined);
+  assert.equal(o.Entrypoint, undefined);
+  assert.equal(o.WorkingDir, undefined);
+  assert.deepEqual(o.Labels, { 'my.label': 'x' });
+  assert.deepEqual(o.ExposedPorts, { '9000/tcp': {} });
+  assert.equal(o.Volumes, undefined);
+  assert.equal(o.Hostname, undefined); // default hostname = short ID
+  assert.deepEqual(o.HostConfig.RestartPolicy, { Name: 'unless-stopped' });
+});
+
+test('buildRecreateOptions: keeps a user-set command and hostname', () => {
+  const o = buildRecreateOptions(
+    { ...inspect, Config: { ...inspect.Config, Cmd: ['serve', '--debug'], Hostname: 'myhost' } },
+    baseImage,
+    'app:latest'
+  );
+  assert.deepEqual(o.Cmd, ['serve', '--debug']);
+  assert.equal(o.Hostname, 'myhost');
+});
+
+test('buildRecreateOptions: re-attaches anonymous volumes so their data survives', () => {
+  const o = buildRecreateOptions(inspect, baseImage, 'app:latest');
+  assert.deepEqual(o.HostConfig.Binds, ['/srv/conf:/conf:ro', `${'f'.repeat(64)}:/data`]);
+  // Does not mutate the inspect data.
+  assert.deepEqual(inspect.HostConfig.Binds, ['/srv/conf:/conf:ro']);
+});
+
+test('buildRecreateOptions: network endpoints keep aliases but drop runtime state', () => {
+  const o = buildRecreateOptions(inspect, baseImage, 'app:latest');
+  assert.deepEqual(o.NetworkingConfig.EndpointsConfig, { web: { Aliases: ['app'] } });
+});
+
+test('buildRecreateOptions: without the base image config, everything is kept', () => {
+  const o = buildRecreateOptions(inspect, null, 'sha256:old');
+  assert.equal(o.Image, 'sha256:old');
+  assert.deepEqual(o.Env, inspect.Config.Env);
+  assert.deepEqual(o.Cmd, ['serve']);
+});
diff --git a/server/test/notify.test.js b/server/test/notify.test.js
index abb93ee..2822c4d 100644
--- a/server/test/notify.test.js
+++ b/server/test/notify.test.js
@@ -5,7 +5,11 @@ import {
   buildNtfyMessage,
   buildGotifyPayload,
   buildWebhookPayload,
+  buildNtfyUrl,
+  sendUpdates,
+  sendTest,
 } from '../src/notify.js';
+import http from 'node:http';
 
 test('buildDiscordPayload: header pluralizes and lists items', () => {
   const p = buildDiscordPayload([
@@ -51,3 +55,46 @@ test('buildWebhookPayload: structured containers array', () => {
   assert.equal(p.containers[0].currentVersion, '10.9.0');
   assert.equal(p.containers[1].currentVersion, null);
 });
+
+test('versions: shows "current → available", and flags same-version rebuilds', () => {
+  const p = buildDiscordPayload([
+    { name: 'a', image: 'a:latest', currentVersion: '1.0.0', availableVersion: '1.1.0' },
+    { name: 'b', image: 'b:latest', currentVersion: '2.0.0', availableVersion: '2.0.0' },
+  ]);
+  assert.match(p.content, /1\.0\.0 → 1\.1\.0/);
+  assert.match(p.content, /2\.0\.0, rebuilt/);
+});
+
+test('buildNtfyUrl: carries title/tags as query params and keeps existing ones', () => {
+  const u = new URL(buildNtfyUrl('https://ntfy.example/topic?auth=abc', { title: '🔔 2 updates', tags: 'package' }));
+  assert.equal(u.searchParams.get('auth'), 'abc');
+  assert.equal(u.searchParams.get('title'), '🔔 2 updates');
+  assert.equal(u.searchParams.get('tags'), 'package');
+});
+
+// Regression: the emoji title used to go in a `Title` header, which fetch
+// rejects (headers must be Latin-1) — so every real ntfy notification threw.
+test('sendUpdates/sendTest (ntfy): emoji titles are delivered, not thrown', async () => {
+  const received = [];
+  const server = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (c) => (body += c));
+    req.on('end', () => {
+      received.push({ url: req.url, body });
+      res.end('ok');
+    });
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const url = `http://127.0.0.1:${server.address().port}/updates`;
+  try {
+    const r1 = await sendUpdates('ntfy', url, items);
+    const r2 = await sendTest('ntfy', url);
+    assert.equal(r1.ok, true);
+    assert.equal(r2.ok, true);
+    const q = new URL(received[0].url, 'http://x').searchParams;
+    assert.match(q.get('title'), /🔔 2 container updates available/);
+    assert.match(received[0].body, /jellyfin/);
+  } finally {
+    server.close();
+  }
+});
diff --git a/server/test/sse.test.js b/server/test/sse.test.js
new file mode 100644
index 0000000..4e3f345
--- /dev/null
+++ b/server/test/sse.test.js
@@ -0,0 +1,60 @@
+import { test, mock } from 'node:test';
+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import * as sse from '../src/sse.js';
+
+function fakeRes() {
+  const res = new EventEmitter();
+  res.chunks = [];
+  res.ended = false;
+  res.writeHead = () => {};
+  res.write = (c) => res.chunks.push(c);
+  res.end = () => {
+    res.ended = true;
+  };
+  return res;
+}
+
+test('a finished session\'s cleanup timer never deletes a newer session with the same name', () => {
+  mock.timers.enable({ apis: ['setTimeout'] });
+  try {
+    sse.startSession('web');
+    sse.finish('web', { success: false, message: 'unhealthy' });
+
+    // Revert started within the grace period.
+    assert.ok(sse.startSession('web'));
+    mock.timers.tick(60_000);
+
+    assert.equal(sse.isActive('web'), true, 'new session must survive the old timer');
+    const res = fakeRes();
+    sse.subscribe('web', res);
+    sse.pushLog('web', 'reverting…');
+    sse.finish('web', { success: true, message: 'Reverted' });
+    const out = res.chunks.join('');
+    assert.match(out, /reverting…/);
+    assert.match(out, /"type":"result","success":true/);
+    assert.equal(res.ended, true);
+  } finally {
+    mock.timers.reset();
+  }
+});
+
+test('a finished session is still replayable during the grace period, then removed', () => {
+  mock.timers.enable({ apis: ['setTimeout'] });
+  try {
+    sse.startSession('db');
+    sse.pushLog('db', 'pulling');
+    sse.finish('db', { success: true, message: 'ok' });
+
+    const late = fakeRes();
+    sse.subscribe('db', late);
+    assert.match(late.chunks.join(''), /pulling[\s\S]*"success":true/);
+
+    mock.timers.tick(31_000);
+    const later = fakeRes();
+    sse.subscribe('db', later);
+    assert.match(later.chunks.join(''), /No active update/);
+  } finally {
+    mock.timers.reset();
+  }
+});