diff --git a/src/pkg/scan/util.go b/src/pkg/scan/util.go
index e7b65b1e0..ac19d92a0 100644
--- a/src/pkg/scan/util.go
+++ b/src/pkg/scan/util.go
@@ -34,8 +34,10 @@ import (
 	v1sq "github.com/goharbor/harbor/src/pkg/scan/rest/v1"
 )
 
+// Insecure ...
 type Insecure bool
 
+// RemoteOptions ...
 func (i Insecure) RemoteOptions() []remote.Option {
 	tr := http.DefaultTransport.(*http.Transport).Clone()
 	tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: bool(i)}
@@ -76,14 +78,14 @@ func GenAccessoryArt(sq v1sq.ScanRequest, accData []byte, accAnnotations map[str
 	// https://github.com/google/go-containerregistry/issues/1832
 	accArt = mutate.MediaType(accArt, ocispec.MediaTypeImageManifest)
 	accArt = mutate.ConfigMediaType(accArt, types.MediaType(mediaType))
-	accArt = mutate.Subject(accArt, *accSubArt).(v1.Image)
 	accArt = mutate.Annotations(accArt, accAnnotations).(v1.Image)
+	accArt = mutate.Subject(accArt, *accSubArt).(v1.Image)
 
-	digest, err := accArt.Digest()
+	dgst, err := accArt.Digest()
 	if err != nil {
 		return "", err
 	}
-	accRef, err := name.ParseReference(fmt.Sprintf("%s/%s@%s", sq.Registry.URL, sq.Artifact.Repository, digest.String()))
+	accRef, err := name.ParseReference(fmt.Sprintf("%s/%s@%s", sq.Registry.URL, sq.Artifact.Repository, dgst.String()))
 	if err != nil {
 		return "", err
 	}
@@ -91,5 +93,5 @@ func GenAccessoryArt(sq v1sq.ScanRequest, accData []byte, accAnnotations map[str
 	if err := remote.Write(accRef, accArt, opts...); err != nil {
 		return "", err
 	}
-	return digest.String(), nil
+	return dgst.String(), nil
 }
diff --git a/src/pkg/scan/util_test.go b/src/pkg/scan/util_test.go
index f293f026a..519d6d68a 100644
--- a/src/pkg/scan/util_test.go
+++ b/src/pkg/scan/util_test.go
@@ -60,5 +60,5 @@ func TestGenAccessoryArt(t *testing.T) {
 	}
 	s, err := GenAccessoryArt(sq, []byte(`{"name": "harborAccTest", "version": "1.0"}`), annotations, "application/vnd.goharbor.harbor.main.v1", r)
 	assert.Nil(t, err)
-	assert.Equal(t, "sha256:8de6104b79deca0253ff8667692f03e34753494c77ec81f631b45aad69223c18", s)
+	assert.Equal(t, "sha256:a39c6456d3cd1d87b7ee5706f67133d7a6d27a2dbc9ed66d50e504ff8920efc3", s)
 }