Pin the whale-built jellyfin-shokofin-plugin image in images.libsonnet and add an init-shokofin-plugin init container to jellyfin.libsonnet that materializes the plugin dir onto Jellyfin's config PVC before startup -- replacing the hand-installed UI plugin with a reproducible, version-pinned install. The init is idempotent and content-addressed (marker = the Shokofin.dll sha256), clears any stray Shoko_* dir so exactly our build loads, and chowns to uid 1000. With autoUpdate disabled in the baked meta.json, Jellyfin's updater can't replace it. The plugin currently carries the VFS_UseSourceFileAsVersionIdentifier backport (see whale/outputs.nix); this install mechanism stays even after the feature lands upstream. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014jeXv3ZvJf3dsENLipLJiG