diff --git a/deploy/manifest/built-in-providers/dev/containerImages.yaml b/deploy/manifest/built-in-providers/dev/containerImages.yaml
index a2f417a158..26f9bb3fe1 100644
--- a/deploy/manifest/built-in-providers/dev/containerImages.yaml
+++ b/deploy/manifest/built-in-providers/dev/containerImages.yaml
@@ -64,14 +64,14 @@ types:
               description: (Required) The Radius Application ID. `myApplication.id` for example.
             tag:
               type: string
-              description: (Optional) Tag for the produced image. When unset, the recipe computes a content-addressable digest (`sha256-<hash>`) from the build inputs. For git sources, pin to a commit SHA or immutable tag (e.g. `?ref=<sha>`) so that the computed tag is genuinely content-addressable; with a moving ref like `?ref=main`, the computed tag does not change when the upstream branch advances.
+              description: (Optional) Tag for the produced image. When omitted, the recipe computes a deterministic tag (`sha256-<hash>`) from the build inputs. A present tag must be a valid non-empty string. For git sources, pin to a commit SHA or immutable tag (e.g. `?ref=<sha>`); with a moving ref like `?ref=main`, the computed tag does not change when the upstream branch advances even though a later build can replace the content behind that tag.
             build:
               type: object
               description: (Required) Build configuration for the container image.
               properties:
                 source:
                   type: string
-                  description: "(Required) Source location for the build. Either a git URL of the form `git::https://...` (BuildKit clones the repo inside the cluster) or a local filesystem path to a directory containing the build context. For git URLs, the subdirectory is selected via the go-getter `//<subdir>` segment and the ref via the `?ref=<branch-or-sha>` query parameter, in that order. Example, `git::https://github.com/myorg/myapp.git//frontend?ref=v1.2.3`."
+                  description: "(Required) Source location for the build. Use a git URL of the form `git::https://...`, which BuildKit clones inside the cluster, or an operator-managed local directory. Radius does not upload workstation source. The default Bicep Recipe accepts local sources only beneath `/var/radius/build-contexts` and rejects symbolic links. The stock Radius Helm chart does not mount this directory; platform engineers using local sources must add a read-only mount by customizing or post-rendering the dynamic-rp Deployment. Git sources require no mount. The Terraform Recipe retains its existing local-path behavior. For git URLs, select a subdirectory with `//<subdir>` and a ref with `?ref=<branch-or-sha>`, in that order. Example: `git::https://github.com/myorg/myapp.git//frontend?ref=v1.2.3`."
                 dockerfile:
                   type: string
                   description: (Optional) Path to the Dockerfile relative to the build source. Defaults to `Dockerfile`.
diff --git a/deploy/manifest/built-in-providers/self-hosted/containerImages.yaml b/deploy/manifest/built-in-providers/self-hosted/containerImages.yaml
index a2f417a158..26f9bb3fe1 100644
--- a/deploy/manifest/built-in-providers/self-hosted/containerImages.yaml
+++ b/deploy/manifest/built-in-providers/self-hosted/containerImages.yaml
@@ -64,14 +64,14 @@ types:
               description: (Required) The Radius Application ID. `myApplication.id` for example.
             tag:
               type: string
-              description: (Optional) Tag for the produced image. When unset, the recipe computes a content-addressable digest (`sha256-<hash>`) from the build inputs. For git sources, pin to a commit SHA or immutable tag (e.g. `?ref=<sha>`) so that the computed tag is genuinely content-addressable; with a moving ref like `?ref=main`, the computed tag does not change when the upstream branch advances.
+              description: (Optional) Tag for the produced image. When omitted, the recipe computes a deterministic tag (`sha256-<hash>`) from the build inputs. A present tag must be a valid non-empty string. For git sources, pin to a commit SHA or immutable tag (e.g. `?ref=<sha>`); with a moving ref like `?ref=main`, the computed tag does not change when the upstream branch advances even though a later build can replace the content behind that tag.
             build:
               type: object
               description: (Required) Build configuration for the container image.
               properties:
                 source:
                   type: string
-                  description: "(Required) Source location for the build. Either a git URL of the form `git::https://...` (BuildKit clones the repo inside the cluster) or a local filesystem path to a directory containing the build context. For git URLs, the subdirectory is selected via the go-getter `//<subdir>` segment and the ref via the `?ref=<branch-or-sha>` query parameter, in that order. Example, `git::https://github.com/myorg/myapp.git//frontend?ref=v1.2.3`."
+                  description: "(Required) Source location for the build. Use a git URL of the form `git::https://...`, which BuildKit clones inside the cluster, or an operator-managed local directory. Radius does not upload workstation source. The default Bicep Recipe accepts local sources only beneath `/var/radius/build-contexts` and rejects symbolic links. The stock Radius Helm chart does not mount this directory; platform engineers using local sources must add a read-only mount by customizing or post-rendering the dynamic-rp Deployment. Git sources require no mount. The Terraform Recipe retains its existing local-path behavior. For git URLs, select a subdirectory with `//<subdir>` and a ref with `?ref=<branch-or-sha>`, in that order. Example: `git::https://github.com/myorg/myapp.git//frontend?ref=v1.2.3`."
                 dockerfile:
                   type: string
                   description: (Optional) Path to the Dockerfile relative to the build source. Defaults to `Dockerfile`.
diff --git a/deploy/manifest/defaults.yaml b/deploy/manifest/defaults.yaml
index f74f5cff09..56c3adbf7e 100644
--- a/deploy/manifest/defaults.yaml
+++ b/deploy/manifest/defaults.yaml
@@ -29,7 +29,7 @@ sources:
     repo: github.com/radius-project/resource-types-contrib
     # An immutable commit SHA (Phase A). A branch or tag is also accepted by the
     # fetch, but update-resource-types always pins a full commit SHA.
-    ref: 158be1959352e2c23e22488ae7d26c772c989de1
+    ref: cfe0e011c1a37b383d7c5bf51068fc6e9ebba04d
   - namespace: Radius.Data
     repo: github.com/radius-project/resource-types-contrib
     ref: 158be1959352e2c23e22488ae7d26c772c989de1