Specify service image with digest, not with tag

Hi,

I want to set up my GitLab CI/CD pipeline with a service. Because of a broken image (already reported to the owner), I don’t want to use the latest tag but to specify the image by its digest:

[...]
.check pdfa compliance template:
  stage: validate
  needs:
    - job: build pdfs
      artifacts: true
  image: alpine
  services:
    - name: verapdf/rest@sha256:ca3d3c501642efa633252c8a1aeba835a0eecac52b954d3fc13fd76e7fb3e382
      alias: verapdf
  before_script:
    - apk add --no-cache curl jq
  script:
    - curl -F "file=@${filename}" verapdf:8080/api/validate/1b > verapdf-validation-results.json
    - cat verapdf-validation-results.json | jq
    - if [ "$(cat verapdf-validation-results.json | jq .compliant)" != "true" ] ; then exit 1 ; fi
  artifacts:
    paths:
      - "verapdf-validation-results.json"

pdfa compliance check cost-fairness-extended.pdf:
  extends: .check pdfa compliance template
  variables:
    filename: cost-fairness-extended.pdf

However, when running the job, it still uses the latest image: Using docker image sha256:1352d02088fce4a38b429652f9375a50e51b56302399077dce882f163ff55f37 for verapdf/rest:latest with digest verapdf/rest@sha256:b4b73981a8ee2105c2d2ce8a8dbdb5ce42aed8f0402bf690b6b092fcff7f0335 ....

Why is that? How can I force it to use the image referenced by the digest?

Best regards
Matthias