diff --git a/server/routes/updates.ts b/server/routes/updates.ts
index c302047..30125b9 100644
--- a/server/routes/updates.ts
+++ b/server/routes/updates.ts
@@ -149,6 +149,10 @@ router.get('/docker', async (_req, res) => {
         // Skip ephemeral CI/pipeline containers
         if (containerName.startsWith('wp_')) continue
 
+        // Skip containers with no real name or image tag (sha256-only)
+        const isShaTag = rawImage.startsWith('sha256:') || rawImage.includes('@sha256:') && !rawImage.includes(':')
+        if (!containerName || isShaTag) continue
+
         // Get repo digests via image inspect
         let repoDigest: string | null = null
         try {
diff --git a/src/components/widgets/DockerUpdatesWidget.tsx b/src/components/widgets/DockerUpdatesWidget.tsx
index 2cf337e..fd56ada 100644
--- a/src/components/widgets/DockerUpdatesWidget.tsx
+++ b/src/components/widgets/DockerUpdatesWidget.tsx
@@ -55,7 +55,7 @@ export function DockerUpdatesWidget() {
               <div className="list-item-left" style={{ flexDirection: 'column', alignItems: 'flex-start', gap: 2 }}>
                 <span>{c.name}</span>
                 <span style={{ fontFamily: 'JetBrains Mono, monospace', fontSize: 10, color: 'var(--muted)' }}>
-                  {c.image}:{c.tag} · {c.endpoint}
+                  {c.image}:{c.tag.startsWith('sha256:') ? c.tag.slice(0, 15) + '…' : c.tag} · {c.endpoint}
                 </span>
               </div>
               {c.upToDate === null && c.registry !== 'docker.io' && c.registry !== 'ghcr.io' ? (