diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 31fae852f..eb3c1c162 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -17,6 +17,10 @@ on:
         type: boolean
 
 env:
+  # TODO: when a manual release is pushed this version will be used all the time,
+  # but for hotfixes we must make sure that the `make version` is called before it.defaults:
+  # Maybe we can make it part of cd.yml?
+  #
   # mark:automatic-version
   VERSION: "1.20231001.0"
 
@@ -122,7 +126,7 @@ jobs:
             "Apply Run from GitHub Actions CI ${{ inputs.tag || github.sha }}"
 
   publish-images-to-ghcr:
-    if: github.ref == 'refs/heads/main'
+    if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'release' }}
     needs: deploy-production
     runs-on: ubuntu-22.04
     strategy: