How to enable tag immutability in quay.io?
At first glance, it seems that tag immutability is not a feature provided by Quay. You can enable &quot;Trust and Signing&quot; in the &quot;settings&quot; of the repo:

Please note that this will not prevent users from overwriting signed tags without updating signatures. This means that:

Any tag operations in the UI or client can cause inconsistency
Builds should not push to signed tags

We recommend you maintain a strict separation between signed and unsigned tags to avoid any issues with garbage collection.

So, you can sign tags, but you can't prevent them from being updated.