diff --git a/container-vm/main.tf b/container-vm/main.tf
index bd4787b..6767079 100644
--- a/container-vm/main.tf
+++ b/container-vm/main.tf
@@ -42,7 +42,7 @@ resource "google_compute_instance_template" "container_vm_template" {
 
   # Service Account configuration (needed for Google Cloud API access, including image pulls)
   service_account {
-    email  = "default" # Use the project's default compute service account
+    email  = var.service_account_email
     scopes = ["cloud-platform"]
   }
 
diff --git a/container-vm/variables.tf b/container-vm/variables.tf
index 747aa5f..c2a8c6e 100644
--- a/container-vm/variables.tf
+++ b/container-vm/variables.tf
@@ -16,8 +16,13 @@ variable "machine_type" {
 }
 
 variable "container_image" {
-  description = "The container image to run (e.g., 'nginx:latest' or 'gcr.io/my-project/my-app:v1')."
+  description = "The container image to run, must be referenced by digest (e.g., 'gcr.io/my-project/my-app@sha256:abc123...')."
   type        = string
+
+  validation {
+    condition     = can(regex("^.+@sha256:[a-f0-9]{64}$", var.container_image))
+    error_message = "The container_image must be referenced by digest (e.g., 'gcr.io/my-project/my-app@sha256:<64 hex chars>')."
+  }
 }
 
 variable "container_name" {
@@ -50,6 +55,11 @@ variable "container_args" {
   default     = []
 }
 
+variable "service_account_email" {
+  description = "The email of the service account to use for the VM. Must be created outside this module."
+  type        = string
+}
+
 # Defaulting to COS, which has Docker/containerd pre-installed.
 variable "source_image_family" {
   description = "The OS image family to use. COS is recommended."