They should be pulling from a pull through scanning repository cache anyway, so they can be scanned before going into production.