diff --git a/.github/workflows/build-workflow.yaml b/.github/workflows/build-workflow.yaml
index 3e185a8..5df5f7a 100644
--- a/.github/workflows/build-workflow.yaml
+++ b/.github/workflows/build-workflow.yaml
@@ -71,7 +71,11 @@ jobs:
           DATE="${{ steps.meta.outputs.build_date_short }}"
           BRANCH_CLEAN="${{ steps.meta.outputs.branch_clean }}"
 
-          if [[ "$BRANCH" == "main" ]]; then
+          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
+            TAG="${{ github.ref_name }}"
+            TAGS="${IMAGE}:${TAG}
+          ${IMAGE}:latest"
+          elif [[ "$BRANCH" == "main" ]]; then
             TAGS="${IMAGE}:latest
           ${IMAGE}:${VERSION}
           ${IMAGE}:${DATE}"
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 43c1a2c..0acbe37 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -21,8 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: k8s-mgmt-pod
-          # Replace this placeholder with a pinned tag or digest in production.
-          image: ghcr.io/<org>/<repo>/k8s-mgmt-pod:latest
+          image: git.alcatrash.net/michael/k8s-mgmt-pod/k8s-mgmt-pod:v1.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: ssh