diff --git a/.github/actions/setup-docker-environment/action.yaml b/.github/actions/setup-docker-environment/action.yaml
index 7712fe27..6289ed0a 100644
--- a/.github/actions/setup-docker-environment/action.yaml
+++ b/.github/actions/setup-docker-environment/action.yaml
@@ -4,14 +4,19 @@ outputs:
   sha_short:
     description: "The short SHA used for image builds"
     value: ${{ steps.vars.outputs.sha_short }}
+  tag:
+    description: "The tag if run against a tag, otherwise 'canary'"
+    value: ${{ steps.vars.outputs.tag }}
 
 runs:
   using: "composite"
   steps:
-    - name: Get Short SHA
+    - name: Get Short SHA & Tag
       id: vars
       run: |
         echo ::set-output name=sha_short::${GITHUB_SHA::7}
+        TAG=${GITHUB_REF/refs\/tags\//}
+        echo ::set-output name=tag::${TAG:-canary}
       shell: bash
 
     - name: Set up QEMU
diff --git a/.github/workflows/canary_images.yaml b/.github/workflows/images.yaml
similarity index 88%
rename from .github/workflows/canary_images.yaml
rename to .github/workflows/images.yaml
index 1d97cb85..064ae3c9 100644
--- a/.github/workflows/canary_images.yaml
+++ b/.github/workflows/images.yaml
@@ -19,7 +19,7 @@ on:
 
 jobs:
   build-test:
-    if: ${{ github.ref != 'refs/heads/main' }}
+    if: github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -40,7 +40,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
 
   build:
-    if: ${{ github.ref == 'refs/heads/main' }}
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -70,7 +70,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}:canary
+            ghcr.io/${{ github.repository }}:${{ steps.vars.outputs.tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -81,6 +81,6 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}-debian-stable-slim:canary
+            ghcr.io/${{ github.repository }}-debian-stable-slim:${{ steps.vars.outputs.tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max