diff --git a/WORKSPACE b/WORKSPACE
index b6099ca..c630f17 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -245,16 +245,10 @@
     registry = "gcr.io",
     repository = "skia-public/skia-wasm-release",
     # The container_pull documentation[1] recommends specifying a digest (via the "digest" argument)
-    # for reproducible builds.
-    #
-    # We specify the "prod" tag here instead of a digest for simplicity, but this might cause Bazel
-    # to fetch the "prod" image once, cache it, and use it for all subsequent builds, completely
-    # ignoring any new images uploaded to GCR with the "prod" tag.
-    #
-    # This caching problem could be solved by replacing the "tag" argument with a "digest" argument
-    # with the latest digest. But this requires setting up an autoroller to update the digest every
-    # time a new container image is uploaded to GCR.
-    tag = "prod",
+    # for reproducible builds. Specifying "head" ends up not working well because of Bazel caching.
+    # We should only need to update this if CanvasKit adds new APIs that are depended on by
+    # our webapps, and that is not too often.
+    tag = "55c215cfb650300419033ea9a0af364acfd3976c",
 )
 
 # Pulls the gcr.io/skia-public/basealpine container, needed by the skia_app_container macro.
diff --git a/shaders/Makefile b/shaders/Makefile
index ca7c7e1..c26b456 100644
--- a/shaders/Makefile
+++ b/shaders/Makefile
@@ -18,7 +18,7 @@
 	# with @skia//docker/skia-wasm-release/Dockerfile
 	docker run -u $$(id -u ${USER}):$$(id -g ${USER}) --rm \
 	    --volume `pwd`/build:/OUT gcr.io/skia-public/skia-wasm-release:prod \
-	    sh -c "cp -r /tmp/canvaskit /OUT/"
+	    sh -c "cp -r /tmp/canvaskit /tmp/VERSION /OUT/"
 	echo "const SKIA_VERSION = '`cat build/VERSION`';" > build/version.js
 
 .PHONY: push
diff --git a/shaders/README.md b/shaders/README.md
index ea45815..c5e58db 100644
--- a/shaders/README.md
+++ b/shaders/README.md
@@ -12,6 +12,9 @@
 Do not check in those files you copied. You may also need to copy the canvaskit.d.ts to
 //shaders/wasm_libs/types/ in order to appease some IDEs.
 
+When making changes to this app that require a newer version of CanvasKit, be sure to update
+WORKSPACE, specifically the entry for container_pull_skia_wasm.
+
 ## Images
 
 Source images are stored in `gs://skia-public-shader-images` and should be make