How to manage image update in kubernetes manifest for protected branches

Question

I am fairly new to using CI-CD with Gitlab.This is the scenario that I'm dealing with :

1. I am running an app on kubernetes cluster. The state for which is managed using ArgoCD.
2. My gitlab pipeline dockerizes the newly pushed code, and pushes it to the gitlab container registry with commit hash as tag.
3. ArgoCD uses the main branch , a protected branch(does not allow direct push) as the source of truth. How do I update the image tag in kubernetes manifests in the main branch with my pipeline flow ?
4. Let's say I change the access to allow direct push to the main branch, wouldn't the entire process of cloning the repo and then updating and pushing the code with updated image tag be a compute expensive one ?

What is the ideal approach here ?