diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 24104b2..49c3545 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -32,21 +32,28 @@ jobs:
           files: coverage.out
 
   docker:
-    name: docker
     runs-on: ubuntu-latest
     needs:
       - lint
       - test
+    if: github.event_name != 'pull_request'
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v3
-      - uses: docker/setup-qemu-action@v3
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/bake-action@v4
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        env:
+          TAG: ${{ github.ref_name }}
         with:
-          files: "build/package/docker-bake.json"
           push: true
+          files: 'docker-bake.json'
+      - uses: docker/bake-action@v4
+        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        with:
+          push: true
+          files: 'docker-bake.json'
diff --git a/build/package/docker-bake.json b/build/package/docker-bake.json
index b942926..4e9a7c7 100644
--- a/build/package/docker-bake.json
+++ b/build/package/docker-bake.json
@@ -6,11 +6,16 @@
       ]
     }
   },
+  "variable": {
+    "TAG": {
+      "default": "latest"
+    }
+  },
   "target": {
     "soteria": {
       "dockerfile": "build/package/Dockerfile",
       "tags": [
-        "ghcr.io/snapp-incubator/soteria"
+        "ghcr.io/snapp-incubator/soteria:${TAG}"
       ]
     }
   }