How to ensure that the most recent version of a docker container image is being used when deploying a GreenGrass component

I have a GreenGrass component which uses aws.greengrass.DockerApplicationManager to download and run a docker image stored in AWS ECR. In a initial deployment, the GreenGrass core authenticates to ECR and downloads the image defined in recipe.yaml. If the docker image is updated in ECR (and the new image is tagged latest), subsequent deployments do not download the new image and continue to boot containers from the old image stored in the GreenGrass device. I tried to add a "docker pull" as part of the Install stage of the component's Lifecycle, but the command fails because it doesn't have credentials to connect to ECR. I understand that the GreenGrass Core has credentials but I have not been able to attach them to the "docker pull" command.

How can I ensure that the component is always using the "latest" tagged docker image that is available in ECR after a deployment?

Thanks in advance