diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bf105f57c..7a572db09 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,6 +11,7 @@ concurrency:
 
 jobs:
   publish-artifacts:
+    if: ${{ startsWith(github.event.release.name, 'gateway') || startsWith(github.event.release.name, 'headless-client') }}
     runs-on: ubuntu-22.04
     permissions:
       # Needed to upload artifacts to a release
@@ -23,9 +24,6 @@ jobs:
         id: login
         with:
           project: firezone-staging
-      - uses: ./.github/actions/gcp-docker-login
-        with:
-          project: firezone-prod
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
@@ -46,8 +44,8 @@ jobs:
             # mark:next-headless-version
             VERSION="1.2.0"
           else
-            echo "Release doesn't require publishing Docker images"
-            exit 0
+            echo "Shouldn't have gotten here. Exiting."
+            exit 1
           fi
 
           MAJOR_VERSION="${VERSION%%.*}"
@@ -66,7 +64,6 @@ jobs:
           driver-opts: |
             image=moby/buildkit:v0.15.1
       - name: Pull and push
-        if: ${{ steps.set-variables.outputs.artifact == 'gateway' || steps.set-variables.outputs.artifact == 'client' }}
         run: |
           set -xe
 
@@ -75,11 +72,10 @@ jobs:
           docker buildx imagetools create \
             -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ github.sha }} \
             -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.version }} \
-            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.version }} \
             -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.version }}-${{ github.sha }} \
-            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:latest \
             -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.major_version }} \
             -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:${{ steps.set-variables.outputs.major_minor_version }} \
+            -t ghcr.io/firezone/${{ steps.set-variables.outputs.artifact }}:latest \
             $SOURCE_TAG
       - name: Authenticate to Google Cloud
         id: auth