diff --git a/pkg/workflow/docker.go b/pkg/workflow/docker.go
index 25588370af..38bef5149d 100644
--- a/pkg/workflow/docker.go
+++ b/pkg/workflow/docker.go
@@ -103,13 +103,9 @@ func collectDockerImages(tools map[string]any, workflowData *WorkflowData, actio
 			}
 		}
 
-		// Add cli-proxy sidecar container when the cli-proxy is needed (explicitly via
-		// cli-proxy feature flag, or implicitly via integrity-reactions feature flag)
-		// and the AWF version supports it. Without this, --skip-pull causes AWF to fail
-		// because the cli-proxy image was never pulled.
-		cliProxyNeeded := isFeatureEnabled(constants.CliProxyFeatureFlag, workflowData) ||
-			isFeatureEnabled(constants.IntegrityReactionsFeatureFlag, workflowData)
-		if cliProxyNeeded && awfSupportsCliProxy(firewallConfig) {
+		// Add cli-proxy sidecar container when the cli-proxy is needed.
+		// Without this, --skip-pull causes AWF to fail because the cli-proxy image was never pulled.
+		if isCliProxyNeeded(workflowData) {
 			cliProxyImage := constants.DefaultFirewallRegistry + "/cli-proxy:" + awfImageTag
 			if !imageSet[cliProxyImage] {
 				images = append(images, cliProxyImage)