diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af3d1137..d115eec6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,6 +65,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -190,6 +195,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Attach the standalone compose file to the release
diff --git a/.github/workflows/cife.yml b/.github/workflows/cife.yml
index 11ddaa9f..cf9d1241 100644
--- a/.github/workflows/cife.yml
+++ b/.github/workflows/cife.yml
@@ -68,6 +68,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/sandbox-image.yml b/.github/workflows/sandbox-image.yml
index 96303100..61e28542 100644
--- a/.github/workflows/sandbox-image.yml
+++ b/.github/workflows/sandbox-image.yml
@@ -80,6 +80,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx