diff --git a/changelogs/unreleased/3803-2uasimojo b/changelogs/unreleased/3803-2uasimojo
new file mode 100644
index 000000000..0c9ea2b1c
--- /dev/null
+++ b/changelogs/unreleased/3803-2uasimojo
@@ -0,0 +1 @@
+Support pulling plugin images by digest
diff --git a/pkg/builder/container_builder.go b/pkg/builder/container_builder.go
index 981b76c3f..80c99955d 100644
--- a/pkg/builder/container_builder.go
+++ b/pkg/builder/container_builder.go
@@ -60,11 +60,18 @@ func getName(image string) string {
 		start = slashIndex + 1
 	}
 
-	// this removes the tag
-	colonIndex := strings.LastIndex(image, ":")
+	// If the image spec is by digest, remove the digest.
+	// If it is by tag, remove the tag.
+	// Otherwise (implicit :latest) leave it alone.
 	end := len(image)
-	if colonIndex > 0 {
-		end = colonIndex
+	atIndex := strings.LastIndex(image, "@")
+	if atIndex > 0 {
+		end = atIndex
+	} else {
+		colonIndex := strings.LastIndex(image, ":")
+		if colonIndex > 0 {
+			end = colonIndex
+		}
 	}
 
 	// https://github.com/distribution/distribution/blob/main/docs/spec/api.md#overview
diff --git a/pkg/builder/container_builder_test.go b/pkg/builder/container_builder_test.go
index 654100022..a5c85a909 100644
--- a/pkg/builder/container_builder_test.go
+++ b/pkg/builder/container_builder_test.go
@@ -87,6 +87,11 @@ func TestGetName(t *testing.T) {
 			image:    "projects.registry.vmware.com/tanzu.migrator/route-2-httpproxy:myTag",
 			expected: "tanzu-migrator-route-2-httpproxy",
 		},
+		{
+			name:     "pull by digest",
+			image:    "quay.io/vmware-tanzu/velero@sha256:a75f9e8c3ced3943515f249597be389f8233e1258d289b11184796edceaa7dab",
+			expected: "vmware-tanzu-velero",
+		},
 	}
 
 	for _, test := range tests {