From 0c086c25ef0d1a740c08f7d05f42063c7b0fdd62 Mon Sep 17 00:00:00 2001
From: Mikhail Katychev <mkatych@gmail.com>
Date: Tue, 18 Aug 2026 14:23:42 -0600
Subject: [PATCH] doc: add examples of calling `wkg oci pull` by SHA

---
 README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/README.md b/README.md
index ec0e903..6f3f64a 100644
--- a/README.md
+++ b/README.md
@@ -73,6 +73,14 @@ Publish a package to the configured registry:
 wkg publish path/to/component.wasm
 ```
 
+Pull a component directly from an OCI registry by [tag or by digest](https://specs.opencontainers.org/image-spec/annotations/?v=v1.1.1#IMAGE-SPEC-ANNOTATIONS-4:~:text=SPDX%20License%20Expression%2E-,org%2Eopencontainers%2Eimage%2Eref%2Ename,-Name%20of%20the) to pin an exact immutable artifact:
+
+```sh
+wkg oci pull ghcr.io/webassembly/wasi/http:0.2.1
+# pulls the equivalent artifact
+wkg oci pull ghcr.io/webassembly/wasi/http@sha256:49be4c9201a1b9fe99d589cde205d6096384a77b8767fedeef0e53e480abff49
+```
+
 Fetch WIT dependencies for the current project (uses `wkg.toml` / `wkg.lock`):
 
 ```sh