diff --git a/.github/actions/_lib/compute-deps-hash/action.yml b/.github/actions/_lib/compute-deps-hash/action.yml
index 5a912d9c4261..84b0cd4b8aa3 100644
--- a/.github/actions/_lib/compute-deps-hash/action.yml
+++ b/.github/actions/_lib/compute-deps-hash/action.yml
@@ -63,15 +63,16 @@ runs:
 
         # Resolve the actual base image digest so a new push of a mutable tag
         # (e.g. latest-develop) invalidates the deps cache automatically.
-        base_image_digest=$(docker buildx imagetools inspect \
+        # Fail loudly: an unreadable manifest is an auth/registry problem, and
+        # silently falling back to the tag string stops the deps cache from
+        # tracking the base image at all.
+        if ! base_image_digest=$(docker buildx imagetools inspect \
           "${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}" \
-          --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || true)
-        if [ -n "${base_image_digest}" ]; then
-          base_image_uniq_id="${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}:${base_image_digest}"
-        else
-          echo "🟠 Could not resolve base image digest, falling back to tag string"
-          base_image_uniq_id="${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}"
+          --format '{{json .Manifest.Digest}}' 2>&1 | tr -d '"'); then
+          echo "::error::Cannot read manifest for ${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}: ${base_image_digest}"
+          exit 1
         fi
+        base_image_uniq_id="${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}:${base_image_digest}"
 
         mapfile -t manifest_files < <(git ls-files | grep -E "${deps_manifest_pattern}" || true)
         file_hash=$(git ls-files -s "${deps_files[@]}" "${manifest_files[@]}" 2>/dev/null \
diff --git a/.github/actions/_lib/setup-docker-config/action.yml b/.github/actions/_lib/setup-docker-config/action.yml
index 09effa56eaa3..d3e41e70c274 100644
--- a/.github/actions/_lib/setup-docker-config/action.yml
+++ b/.github/actions/_lib/setup-docker-config/action.yml
@@ -26,18 +26,19 @@ runs:
           exit 0
         fi
 
+        # Seed a CLEAN config - never inherit the runner's registry credentials.
+        # A persistent `docker login nvcr.io` on the runner is stored inline
+        # (the credential helper is broken), and inheriting it makes NGC refuse
+        # to mint a token for the PUBLIC nvidia/* catalog for that org identity
+        # ("denied: Access Denied") instead of falling back to anonymous.
         DOCKER_CONFIG_DIR=$(mktemp -d)
-        if [ -f "${HOME}/.docker/config.json" ]; then
-          python3 -c "import json; cfg=json.load(open('${HOME}/.docker/config.json')); cfg['credsStore']=''; cfg.pop('credHelpers',None); json.dump(cfg,open('${DOCKER_CONFIG_DIR}/config.json','w'))"
-        else
-          echo '{"credsStore":""}' > "${DOCKER_CONFIG_DIR}/config.json"
-        fi
+        echo '{"credsStore":"","auths":{}}' > "${DOCKER_CONFIG_DIR}/config.json"
         export DOCKER_CONFIG="${DOCKER_CONFIG_DIR}"
         echo "DOCKER_CONFIG=${DOCKER_CONFIG_DIR}" >> "$GITHUB_ENV"
 
         if [ -n "${NGC_API_KEY:-}" ]; then
           echo "🔵 Logging into nvcr.io..."
-          docker login -u '$oauthtoken' -p "${NGC_API_KEY}" nvcr.io
+          printf '%s' "${NGC_API_KEY}" | docker login -u '$oauthtoken' --password-stdin nvcr.io
         else
           echo "🟠 NGC_API_KEY not set - skipping nvcr.io login (normal for fork PRs)"
         fi