Short version: updating your ECS Service’s task definition (“label-workspace”) does not change the image used to run your flows. Prefect’s ECS worker creates/uses separate task definitions for the flow run itself (“prefect-running-a-flow”), and the image for those is taken from the worker/deployment job variables (or a task definition you explicitly point at) — not from your service’s task definition. Deleting old revisions of “label-workspace” won’t affect flow runs. How Prefect picks the task definition - For each flow run, the ECS worker either: - Uses an explicitly provided

task_definition_arn

exactly as-is, or - Builds/updates a task definition from your ECS job variables (task definition template, image, CPU/memory, env, etc.). - If a family name is used without a revision, AWS always resolves it to the latest ACTIVE revision (not random). Prefect may also cache a specific revision per deployment in-memory until the config changes or the worker restarts. How to force a specific Docker image for your flow runs Pick one of these approaches: 1) One-off and guaranteed: pin to an explicit task definition ARN - Pre-register a task definition whose container

image

is your desired digest. - In the Quick Run “Job variables” (or on the deployment / work pool defaults), set:

{
  "task_definition_arn": "arn:aws:ecs:REGION:ACCOUNT_ID:task-definition/prefect-running-a-flow:REV"
}

- Prefect will use that exact revision and will not register a new task definition for the run. You manage cleanup for that revision. 2) Ongoing default: set the image digest in the ECS job template - In your ECS work pool (or deployment) job variables, ensure the task definition template includes your image digest. For example:

{
  "task_definition": {
    "family": "prefect-running-a-flow",
    "networkMode": "awsvpc",
    "requiresCompatibilities": [
      "FARGATE"
    ],
    "cpu": "1024",
    "memory": "2048",
    "containerDefinitions": [
      {
        "name": "prefect",
        "image": "your-registry/your-image@sha256:YOUR_DIGEST",
        "essential": true,
        "command": [],
        "environment": []
      }
    ]
  }
}

- On the next run, the worker will compare the current config to the latest ACTIVE revision and register a new one if needed. If the worker cached a previous revision for the deployment, restart the worker or make a small config change (e.g., add a no-op env var) to force re-registration. 3) Per-run override in Quick Run - Paste either the explicit

task_definition_arn

or a task_definition override with the

image

digest into the “Job variables” field before starting the run. Why deleting old revisions of “label-workspace” won’t help - “label-workspace” is the service task definition that runs your worker container. Flow runs use separate ECS task definitions that Prefect registers/uses when it calls RunTask. - Only the flow-run task definition’s container image determines what code/image your flow run uses. Extra notes - If you’re using tag-only images (e.g., “my-image:latest”), switch to a digest to ensure you really get the fixed code. - If you’ve enabled auto-deregistration, Prefect will deregister the flow-run task definitions it created after the task stops (it won’t deregister a task definition you provided by ARN). - AWS family name lookups always return the latest ACTIVE revision; there’s no random selection. Helpful references - ECS worker source (how image and task definitions are assembled): prefect_aws/workers/ecs_worker.py If you can share where your flow-run image is currently set (work pool job variables, deployment job variables, or default), I can give you the exact JSON to paste for your setup.