diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index bab7fe56..bda1e40e 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -42,11 +42,11 @@ steps:
       chmod +x ./sg-rfc795
 
       ./sg-rfc795 release run internal finalize --workdir=. --config-from-commit
-  - label: "Promote release to public"
-    if: build.env("RELEASE_PUBLIC") == "true"
+  - label: "Promote to public: finalize"
+    if: "build.branch =~ /^promote-release/"
     command: |
       wget https://storage.googleapis.com/buildkite_public_assets/sg-rfc795.tar.gz
       tar zxf sg-rfc795.tar.gz
       chmod +x ./sg-rfc795
 
-      ./sg-rfc795 release promote-to-public --workdir=. --inputs=server=v5.3.666 --version=v5.3.666
+      ./sg-rfc795 release run promote-to-public finalize --workdir=. --config-from-commit
diff --git a/release.yaml b/release.yaml
index 196737ea..208f2213 100644
--- a/release.yaml
+++ b/release.yaml
@@ -80,7 +80,6 @@ promoteToPublic:
           git checkout origin/wip-release-{{version}}
       - name: "sg ops"
         cmd: |
-          # TODO switch to public
           sg-rfc795 ops update-images \
             --kind k8s \
             --registry us-central1-docker.pkg.dev/sourcegraph-ci/rfc795-public \
@@ -105,3 +104,11 @@ promoteToPublic:
         cmd: |
           git push origin promote-release_{{version}}
           gh pr create -f -t "PRETEND PROMOTE RELEASE WIP: promote-release: build {{version}}" --base wip-release-{{version}}
+    finalize:
+      steps:
+        - name: git:tag
+          cmd: |
+            branch="promote-release_{{version}}"
+            git checkout ${branch}
+            git tag {{version}}
+            git push origin ${branch} --tags