diff --git a/scripts/provision-site-env.sh b/scripts/provision-site-env.sh
index 6af5f25..07cbf57 100755
--- a/scripts/provision-site-env.sh
+++ b/scripts/provision-site-env.sh
@@ -27,7 +27,7 @@ if [[ -z "$DATA_ROOT" || "$DATA_ROOT" == "-h" || "$DATA_ROOT" == "--help" ]]; th
 fi
 shift || true
 
-IMAGE="menu-admin:latest"
+IMAGE=""
 FORCE=0
 for argument in "$@"; do
   case "$argument" in
@@ -48,11 +48,30 @@ if ! command -v docker >/dev/null 2>&1; then
   exit 1
 fi
 
-if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
-  echo "image $IMAGE is not present; pull or build it first" >&2
+# The image is only needed to borrow node for hashing, so take the one the app
+# is already running rather than guessing a name. The playbook names the
+# container menu-app.<domain> for the web address menu.<domain>.
+if [[ -z "$IMAGE" ]]; then
+  for candidate in "menu-app.${DATA_ROOT##*/menu.}" "menu-app.${DATA_ROOT##*/}"; do
+    IMAGE="$(docker inspect --format '{{.Config.Image}}' "$candidate" 2>/dev/null || true)"
+    [[ -n "$IMAGE" ]] && break
+  done
+fi
+
+if [[ -z "$IMAGE" ]]; then
+  echo "could not tell which image to use: no running app container to borrow one from." >&2
+  echo "Pass it explicitly: $0 $DATA_ROOT registry.tanshu.com/menu-admin:<tag>" >&2
   exit 1
 fi
 
+if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
+  echo "image $IMAGE is not present on this host." >&2
+  echo "Pass the one the app runs: $0 $DATA_ROOT registry.tanshu.com/menu-admin:<tag>" >&2
+  exit 1
+fi
+
+echo "hashing with the app's image: $IMAGE"
+
 read -r -s -p "Admin password: " PASSWORD
 echo
 read -r -s -p "Repeat password: " REPEAT