There is a “development” alternative to the live domain and somehow that has sneaked into the configuration such that everything but the images comes from the live domain but the images are coming from the dev domain. As the latter doesn’t have a certificate, we (quite rightly) run into the cross-site security issue and the images don’t load.
We are currently trying to rebuild the container, as suggested elsewhere.