diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d115eec6..5cd9c85e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,9 +67,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -197,9 +199,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Attach the standalone compose file to the release
diff --git a/.github/workflows/cife.yml b/.github/workflows/cife.yml
index cf9d1241..5f801b24 100644
--- a/.github/workflows/cife.yml
+++ b/.github/workflows/cife.yml
@@ -70,9 +70,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/sandbox-image.yml b/.github/workflows/sandbox-image.yml
index 61e28542..c020187a 100644
--- a/.github/workflows/sandbox-image.yml
+++ b/.github/workflows/sandbox-image.yml
@@ -82,9 +82,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx