diff --git a/cloud/dev/scripts/relay-staging-c4-refresh-workflow.test.mjs b/cloud/dev/scripts/relay-staging-c4-refresh-workflow.test.mjs
index 75bbb9ac8d5..0e777b06c38 100644
--- a/cloud/dev/scripts/relay-staging-c4-refresh-workflow.test.mjs
+++ b/cloud/dev/scripts/relay-staging-c4-refresh-workflow.test.mjs
@@ -39,14 +39,17 @@ const launchDigest = '5aedbca5c86de24c8b4d4bf7e3b444b76c712f281ede916cb9d90f70ca
 // so a file-wide count no longer isolates Asia.
 const asiaCells = ['production-gce-c27', 'production-gce-c28', 'production-gce-c29']
 
-function productionCell(cellId) {
-  const start = productionTfvars.indexOf(`"${cellId}"`)
+function cellBlock(tfvars, cellId) {
+  const start = tfvars.indexOf(`"${cellId}"`)
   assert.notEqual(start, -1, `${cellId} is missing`)
-  return productionTfvars.slice(start, productionTfvars.indexOf('\n  }', start))
+  return tfvars.slice(start, tfvars.indexOf('\n  }', start))
 }
 
+const productionCell = (cellId) => cellBlock(productionTfvars, cellId)
+
+// Scoped to C4 by name: staging C3 serves this digest too since its 2026-09-03 re-pin.
 test('pins staging C4 and all production Asia cells to the same launch image', () => {
-  assert.equal(stagingTfvars.match(new RegExp(launchDigest, 'g'))?.length, 1)
+  assert.match(cellBlock(stagingTfvars, 'staging-gce-c4'), new RegExp(`relay@sha256:${launchDigest}"`))
   for (const cellId of asiaCells) {
     assert.match(productionCell(cellId), new RegExp(`relay@sha256:${launchDigest}"`), cellId)
   }
diff --git a/cloud/infra/terraform/environments/staging.tfvars b/cloud/infra/terraform/environments/staging.tfvars
index 3ee108fe874..bb894744612 100644
--- a/cloud/infra/terraform/environments/staging.tfvars
+++ b/cloud/infra/terraform/environments/staging.tfvars
@@ -67,7 +67,7 @@ relay_gce_cells = {
     boot_disk_gb                = 30
     boot_image                  = "https://www.googleapis.com/compute/v1/projects/cos-cloud/global/images/cos-stable-121-18867-528-7"
     capacity_requests           = 4000
-    image                       = "us-central1-docker.pkg.dev/onorca-cloud-staging/orca-cloud/relay@sha256:9fba2a189ab3fa29853800830e77c7551ab3aaa8f43f3cd9adbdea28b876a8b9"
+    image                       = "us-central1-docker.pkg.dev/onorca-cloud-staging/orca-cloud/relay@sha256:5aedbca5c86de24c8b4d4bf7e3b444b76c712f281ede916cb9d90f70cad1e563"
     initially_enabled           = false
     connection_hard_cap         = 1000
     connection_unobserved_bound = 60