diff --git a/pkg/controllers/reconciler.go b/pkg/controllers/reconciler.go
index d1c38d3c6..eee7d7940 100644
--- a/pkg/controllers/reconciler.go
+++ b/pkg/controllers/reconciler.go
@@ -158,10 +158,13 @@ func UpgradeImages(ctx context.Context, image *string, initimage *string) (upgra
 		if s == nil {
 			continue
 		}
-
+		// e.g. intel-dsa-plugin@sha256:hash -> [intel-dsa-plugin@sha256, hash]
 		if parts := strings.SplitN(*s, ":", 2); len(parts) == 2 && len(parts[0]) > 0 {
-			name, version := parts[0], parts[1]
+			// e.g. [intel-dsa-plugin@sha256, hash] -> [intel-dsa-plugin, hash]
+			name, version := strings.TrimSuffix(parts[0], "@sha256"), parts[1]
 
+			// e.g. intel-dsa-plugin -> INTEL_DSA_PLUGIN_SHA
+			// and get the value of the env var INTEL_DSA_PLUGIN_SHA
 			envVarValue := os.Getenv(strings.ReplaceAll(strings.ToUpper(filepath.Base(name)), "-", "_") + "_SHA")
 
 			if envVarValue != "" && *s != envVarValue {
diff --git a/pkg/controllers/reconciler_test.go b/pkg/controllers/reconciler_test.go
index c2ff136b9..7dc176634 100644
--- a/pkg/controllers/reconciler_test.go
+++ b/pkg/controllers/reconciler_test.go
@@ -16,6 +16,7 @@ package controllers
 
 import (
 	"context"
+	"os"
 	"testing"
 
 	v1 "k8s.io/api/core/v1"
@@ -27,6 +28,7 @@ func TestUpgrade(test *testing.T) {
 	version := ":" + ImageMinVersion.String()
 	prevVersion := ":" + ImageMinVersion.WithMinor(ImageMinVersion.Minor()-1).String()
 	tests := []struct {
+		envVars           map[string]string
 		image             string
 		initimage         string
 		expectedImage     string
@@ -61,11 +63,37 @@ func TestUpgrade(test *testing.T) {
 			expectedInitimage: initimage,
 			upgrade:           false,
 		},
+		{
+			envVars: map[string]string{
+				"INTEL_DSA_PLUGIN_SHA":                "intel/intel-dsa-plugin@sha256:000000000000000000000000000000000000000000000000000000000000000b",
+				"INTEL_IDXD_CONFIG_INITCONTAINER_SHA": "intel/intel-idxd-config-initcontainer@sha256:000000000000000000000000000000000000000000000000000000000000000b",
+			},
+			image:             image + "@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+			expectedImage:     image + "@sha256:000000000000000000000000000000000000000000000000000000000000000b",
+			initimage:         initimage + "@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+			expectedInitimage: initimage + "@sha256:000000000000000000000000000000000000000000000000000000000000000b",
+			upgrade:           true,
+		},
+		{
+			envVars: map[string]string{
+				"INTEL_DSA_PLUGIN_SHA":                "intel/intel-dsa-plugin@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+				"INTEL_IDXD_CONFIG_INITCONTAINER_SHA": "intel/intel-idxd-config-initcontainer@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+			},
+			image:             image + "@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+			expectedImage:     image + "@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+			initimage:         initimage + "@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+			expectedInitimage: initimage + "@sha256:000000000000000000000000000000000000000000000000000000000000000a",
+			upgrade:           false,
+		},
 	}
 
 	for i := range tests {
 		t := tests[i]
 
+		for key, value := range t.envVars {
+			os.Setenv(key, value)
+		}
+
 		upgrade := UpgradeImages(context.Background(), &t.image, &t.initimage)
 
 		if !(upgrade == t.upgrade && t.image == t.expectedImage && t.initimage == t.expectedInitimage) {
@@ -73,6 +101,10 @@ func TestUpgrade(test *testing.T) {
 			test.Errorf("expectedImage: %s, received: %s", t.expectedImage, t.image)
 			test.Errorf("expectedInitimage: %s, received: %s", t.expectedInitimage, t.initimage)
 		}
+
+		for key := range t.envVars {
+			os.Unsetenv(key)
+		}
 	}
 }