diff --git a/scripts/compute-tags.sh b/scripts/compute-tags.sh
index d2077aea97b..077852d51d1 100644
--- a/scripts/compute-tags.sh
+++ b/scripts/compute-tags.sh
@@ -16,18 +16,7 @@ GITHUB_SHA=${GITHUB_SHA:?'expecting GITHUB_SHA env var'}
 # allow substituting for ggrep on Mac, since its default grep doesn't grok -P flag.
 GREP=${GREP:-"grep"}
 
-## If we are on a release tag, let's extract the version number.
-## The other possible values are 'main' or another branch name.
-if [[ $BRANCH =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    MAJOR_MINOR_PATCH=$(echo "${BRANCH}" | ${GREP} -Po "([\d\.]+)")
-    MAJOR_MINOR=$(echo "${MAJOR_MINOR_PATCH}" | awk -F. '{print $1"."$2}')
-    MAJOR=$(echo "${MAJOR_MINOR_PATCH}" | awk -F. '{print $1}')
-else
-    MAJOR_MINOR_PATCH="latest"
-    MAJOR_MINOR=""
-    MAJOR=""
-fi
-
+# accumulate output in this variable
 IMAGE_TAGS=""
 
 # append given tag for docker.io and quay.io
@@ -40,14 +29,20 @@ tags() {
 }
 
 tags "${BASE_BUILD_IMAGE}"
-tags "${BASE_BUILD_IMAGE}:${MAJOR_MINOR_PATCH}"
 
-if [ "${MAJOR_MINOR}x" != "x" ]; then
-    tags "${BASE_BUILD_IMAGE}:${MAJOR_MINOR}"
-fi
+## If we are on a release tag, let's extract the version number.
+## The other possible values are 'main' or another branch name.
+if [[ $BRANCH =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    MAJOR_MINOR_PATCH=$(echo "${BRANCH}" | ${GREP} -Po "([\d\.]+)")
+    MAJOR_MINOR=$(echo "${MAJOR_MINOR_PATCH}" | awk -F. '{print $1"."$2}')
+    MAJOR=$(echo "${MAJOR_MINOR_PATCH}" | awk -F. '{print $1}')
 
-if [ "${MAJOR}x" != "x" ]; then
+    tags "${BASE_BUILD_IMAGE}:${MAJOR_MINOR_PATCH}"
+    tags "${BASE_BUILD_IMAGE}:${MAJOR_MINOR}"
     tags "${BASE_BUILD_IMAGE}:${MAJOR}"
+    tags "${BASE_BUILD_IMAGE}:latest"
+elif [[ $BRANCH != "main" ]]; then
+    tags "${BASE_BUILD_IMAGE}:latest"
 fi
 
 tags "${BASE_BUILD_IMAGE}-snapshot:${GITHUB_SHA}"
diff --git a/scripts/compute-tags.test.sh b/scripts/compute-tags.test.sh
index 91021f24d9b..2fbd13815a3 100644
--- a/scripts/compute-tags.test.sh
+++ b/scripts/compute-tags.test.sh
@@ -34,9 +34,19 @@ out=""
 expect() {
     echo '   Actual:' "$out"
     while [ "$#" -gt 0 ]; do
-        echo '   checking' "$1"
-        assertContains "actual !!$out!!" "$out" "--tag docker.io/$1"
-        assertContains "actual !!$out!!" "$out" "--tag quay.io/$1"
+        echo '   checking includes' "$1"
+        assertContains "actual [$out]" "$out" "--tag docker.io/$1"
+        assertContains "actual [$out]" "$out" "--tag quay.io/$1"
+        shift
+    done
+}
+
+expectNot() {
+    echo '   Actual:' "$out"
+    while [ "$#" -gt 0 ]; do
+        echo '   checking excludes' "$1"
+        assertNotContains "actual [$out]" "$out" "--tag docker.io/$1"
+        assertNotContains "actual [$out]" "$out" "--tag quay.io/$1"
         shift
     done
 }
@@ -54,21 +64,20 @@ testRandomBranch() {
 
 testMainBranch() {
     out=$(BRANCH=main GITHUB_SHA=sha bash "$computeTags" foo/bar)
-    # TODO we do not want :latest tag in this scenario for non-snapshot images
     expected=(
         "foo/bar"
-        "foo/bar:latest"
         "foo/bar-snapshot:sha"
         "foo/bar-snapshot:latest"
     )
     expect "${expected[@]}"
+    expectNot "foo/bar:latest"
 }
 
 testSemVerBranch() {
     out=$(BRANCH=v1.2.3 GITHUB_SHA=sha bash "$computeTags" foo/bar)
-    # TODO we want :latest tag in this scenario, it's currently not produced
     expected=(
         "foo/bar"
+        "foo/bar:latest"
         "foo/bar:1"
         "foo/bar:1.2"
         "foo/bar:1.2.3"