diff --git a/src/sophios/api/pythonapi.py b/src/sophios/api/pythonapi.py
index 7de5b3a2..f370356d 100644
--- a/src/sophios/api/pythonapi.py
+++ b/src/sophios/api/pythonapi.py
@@ -2,6 +2,7 @@
 """CLT utilities."""
 import logging
 from pathlib import Path
+import subprocess as sub
 from typing import Any, ClassVar, Optional, TypeVar, Union
 
 import cwl_utils.parser as cu_parser
@@ -753,6 +754,14 @@ def run(self) -> None:
         args = get_args(self.process_name)  # Use mock CLI args
         rose_tree: RoseTree = compiler_info.rose
 
+        # cwl-docker-extract recursively `docker pull`s all images in all subworkflows.
+        # This is important because cwltool only uses `docker run` when executing
+        # workflows, and if there is a local image available,
+        # `docker run` will NOT query the remote repository for the latest image!
+        # cwltool has a --force-docker-pull option, but this may cause multiple pulls in parallel.
+        cmd = ['cwl-docker-extract', '--force-download', f'autogenerated/{self.process_name}.cwl']
+        sub.run(cmd, check=True)
+
         # If you don't like it, you can programmatically overwrite anything in args
         # args.docker_remove_entrypoints = True
         if args.docker_remove_entrypoints: