diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 505c2ff..f0b0028 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -16,9 +16,11 @@
 name: Publish image
 
 # Build and push the Docker image to the IPCR
-# (ipcr-push-watch.nsl.sh) on version tags only.
+# on main (tags main + short sha) and on v* tags (version; latest).
 on:
   push:
+    branches:
+      - main
     tags:
       - 'v*'
 
@@ -69,7 +71,10 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=raw,value=latest
+            type=ref,event=branch
+            type=sha,format=short
+            # latest = newest release, not main
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Build and push
         uses: docker/build-push-action@v6