diff --git a/cli/command/service/create.go b/cli/command/service/create.go
index cfc2830f55..7dadb6ba77 100644
--- a/cli/command/service/create.go
+++ b/cli/command/service/create.go
@@ -92,7 +92,7 @@ func runCreate(dockerCli *command.DockerCli, flags *pflag.FlagSet, opts *service
 		service.TaskTemplate.ContainerSpec.Configs = configs
 	}
 
-	if err := resolveServiceImageDigest(dockerCli, &service); err != nil {
+	if err := resolveServiceImageDigestContentTrust(dockerCli, &service); err != nil {
 		return err
 	}
 
@@ -106,6 +106,8 @@ func runCreate(dockerCli *command.DockerCli, flags *pflag.FlagSet, opts *service
 		createOpts.EncodedRegistryAuth = encodedAuth
 	}
 
+	createOpts.QueryRegistry = true
+
 	response, err := apiClient.ServiceCreate(ctx, service, createOpts)
 	if err != nil {
 		return err
diff --git a/cli/command/service/trust.go b/cli/command/service/trust.go
index 650f0d95c0..ec199a770a 100644
--- a/cli/command/service/trust.go
+++ b/cli/command/service/trust.go
@@ -15,10 +15,10 @@ import (
 	"golang.org/x/net/context"
 )
 
-func resolveServiceImageDigest(dockerCli command.Cli, service *swarm.ServiceSpec) error {
+func resolveServiceImageDigestContentTrust(dockerCli command.Cli, service *swarm.ServiceSpec) error {
 	if !command.IsTrusted() {
-		// Digests are resolved by the daemon when not using content
-		// trust.
+		// When not using content trust, digest resolution happens later when
+		// contacting the registry to retrieve image information.
 		return nil
 	}
 
diff --git a/cli/command/service/update.go b/cli/command/service/update.go
index ef5452fd3c..a57145afa6 100644
--- a/cli/command/service/update.go
+++ b/cli/command/service/update.go
@@ -164,9 +164,10 @@ func runUpdate(dockerCli *command.DockerCli, flags *pflag.FlagSet, options *serv
 	}
 
 	if flags.Changed("image") {
-		if err := resolveServiceImageDigest(dockerCli, spec); err != nil {
+		if err := resolveServiceImageDigestContentTrust(dockerCli, spec); err != nil {
 			return err
 		}
+		updateOpts.QueryRegistry = true
 	}
 
 	updatedSecrets, err := getUpdatedSecrets(apiClient, flags, spec.TaskTemplate.ContainerSpec.Secrets)