diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 24a2433a0..2f55c6597 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -4,6 +4,10 @@ on:
     branches:
       - main
 
+env:
+  # mark:automatic-version
+  VERSION: "1.20231001.0"
+
 # Cancel old workflow runs if new code is pushed
 concurrency:
   group: "cd-${{ github.workflow }}-${{ github.ref }}"
@@ -69,9 +73,9 @@ jobs:
         uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.4
         id: apply-run
         env:
-          TF_VAR_api_image_tag: '"${{ github.sha }}"'
-          TF_VAR_web_image_tag: '"${{ github.sha }}"'
-          TF_VAR_relay_image_tag: '"${{ github.sha }}"'
+          TF_VAR_api_image_tag: '"${{ env.VERSION }}-${{ github.sha }}"'
+          TF_VAR_web_image_tag: '"${{ env.VERSION }}-${{ github.sha }}"'
+          TF_VAR_relay_image_tag: '"${{ env.VERSION }}-${{ github.sha }}"'
         with:
           workspace: ${{ env.TF_WORKSPACE }}
           configuration_version:
@@ -111,5 +115,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          # mark:automatic-version
-          version: 1.20231001.0
+          version: ${{ env.VERSION }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 860b438fd..a9099e429 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,13 +29,11 @@ jobs:
       matrix:
         include:
           - image_name: api
-            push: ${{ github.ref == 'refs/heads/main' }}
             target: runtime
             context: elixir
             build-args: |
               APPLICATION_NAME=api
           - image_name: web
-            push: ${{ github.ref == 'refs/heads/main' }}
             target: runtime
             context: elixir
             build-args: |
@@ -47,19 +45,16 @@ jobs:
             build-args: |
               PACKAGE=firezone-gateway
           - image_name: relay
-            push: ${{ github.ref == 'refs/heads/main' }}
             target: runtime
             context: rust
             build-args: |
               PACKAGE=relay
           - image_name: client
-            push: false
             target: runtime
             context: rust
             build-args: |
               PACKAGE=firezone-headless-client
           - image_name: elixir
-            push: false
             target: builder
             context: elixir
             build-args: |
@@ -98,11 +93,10 @@ jobs:
           cache-to: >-
             type=registry,ref=${{ steps.login.outputs.registry }}/firezone/${{ matrix.image_name }}-buildcache:${{ env.CACHE_TAG }}
           file: ${{ matrix.context }}/Dockerfile
-          push: ${{ matrix.push }}
+          push: true
           target: ${{ matrix.target }}
           tags: |
-            ${{ steps.login.outputs.registry }}/firezone/${{ matrix.image_name }}:${{ env.VERSION }}
-            ${{ steps.login.outputs.registry }}/firezone/${{ matrix.image_name }}:${{ github.sha }}
+            ${{ steps.login.outputs.registry }}/firezone/${{ matrix.image_name }}:${{ env.VERSION }}-${{ github.sha }}
             ${{ steps.login.outputs.registry }}/firezone/${{ matrix.image_name }}:latest
 
   integration-tests: