diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 66b9d039c99..a10e173b69a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -6,6 +6,12 @@ on:
     tags:
       - "v*"
 
+env:
+  ORIGIN_TAG: v1.7.1
+  KERNEL_TAG: v1.7.1
+  SBC_TAG: v1.7.1
+  RK3588_TAG: v1.7.1
+
 jobs:
   talos-image:
     runs-on: buildjet-4vcpu-ubuntu-2204-arm
@@ -31,26 +37,26 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: siderolabs/talos
-          ref: v1.7.1
+          ref: $ORIGIN_TAG
           # need history for `git describe` to work for Talos `Makefile`
           fetch-depth: 0
           fetch-tags: true
 
-      - name: Build and push Talos installer image
-        run: make installer
-        env:
-          PUSH: '1'
-          PKG_KERNEL: ghcr.io/nberlee/kernel:v1.7.1
-          USERNAME: ${{ github.actor }}
-          PLATFORM: linux/arm64
-          PROGRESS: plain
-          CI_ARGS: "--cache-from=ghcr.io/${{ github.actor }}/installer:cache --cache-to=ghcr.io/${{ github.actor }}/installer:cache"
+      - name: Set Environment Variable
+        run: |
+          if [[ $GITHUB_REF == refs/tags/* ]]; then
+            echo "PUBLISH_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          else
+            echo "PUBLISH_TAG=${GITHUB_SHA}" >> $GITHUB_ENV
+          fi
+        shell: bash
 
       - name: Build and push Talos imager image
         run: make imager
         env:
           PUSH: '1'
-          PKG_KERNEL: ghcr.io/nberlee/kernel:v1.7.1
+          TAG: ${{ env.PUBLISH_TAG }}
+          PKG_KERNEL: ghcr.io/nberlee/kernel:$KERNEL_TAG
           USERNAME: ${{ github.actor }}
           PLATFORM: linux/arm64
           INSTALLER_ARCH: arm64
@@ -69,19 +75,18 @@ jobs:
           USERNAME: ${{ github.actor }}
           PLATFORM: linux/arm64
           PROGRESS: plain
-          IMAGER_ARGS: "--system-extension-image ghcr.io/nberlee/rk3588:v1.7.1 --overlay-image ghcr.io/nberlee/sbc-turingrk1:v1.7.1 --overlay-name=turingrk1"
+          IMAGER_ARGS: "--system-extension-image ghcr.io/nberlee/rk3588:$RK3588_TAG --overlay-image ghcr.io/nberlee/sbc-turingrk1:$SBC_TAG --overlay-name=turingrk1"
 
       - name: Build an turing-rk1 installer
         run: |
           make image-installer
           curl -sL "https://github.com/google/go-containerregistry/releases/download/v0.19.1/go-containerregistry_Linux_arm64.tar.gz" | tar -zxv -C /usr/local/bin/ crane
-          IMAGETAG=$(git describe --tag --always --dirty --match v[0-9]\*)
-          crane push _out/installer-arm64.tar ghcr.io/nberlee/installer:$IMAGETAG-rk3588
+          crane push _out/installer-arm64.tar ghcr.io/nberlee/installer:${{ env.PUBLISH_TAG }}-rk3588
         env:
           USERNAME: ${{ github.actor }}
           PLATFORM: linux/arm64
           PROGRESS: plain
-          IMAGER_ARGS: "--system-extension-image ghcr.io/nberlee/rk3588:v1.7.1 --overlay-image ghcr.io/nberlee/sbc-turingrk1:v1.7.1 --overlay-name=turingrk1"
+          IMAGER_ARGS: "--system-extension-image ghcr.io/nberlee/rk3588:$RK3588_TAG --overlay-image ghcr.io/nberlee/sbc-turingrk1:$SBC_TAG --overlay-name=turingrk1"
 
       - uses: actions/upload-artifact@v3
         with: