If it's an important image part of prod, they're pinned to a specific version anyway and get upgraded like software dependencies after testing about once a week. If it's a utility image (e.g. for the cloud dev environment), there's a periodic job that checks for updates every hour because no one would care enough to update manually.