Docker Hub answers with both token and access_token, which made the serde alias fail as a duplicate field, so every Hub image reported that no token was returned. Candidates now also have to match the shape of the running tag; cert-manager v1.14.5 was otherwise offered an upgrade to the build id 608111629. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>