diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index f8b7e45..2dde49c 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -1,5 +1,5 @@
-# Build the Crucible image. PR-first (D7): PRs build only; push to main also
-# publishes registry.westgate.pw/deployment/crucible:<git-sha>. Never a mutable tag.
+# Build the Crucible image (D7 trigger standard): PRs/main build only; tag `v*`
+# publishes registry.westgate.pw/deployment/crucible:<sha>. Never a mutable tag.
 #
 # Daemonless: the host-mode runner has no container runtime, so the image is
 # built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
@@ -7,9 +7,10 @@
 name: build-image
 
 on:
+  pull_request:
   push:
     branches: [main]
-  pull_request:
+    tags: ['v*']
 
 env:
   REGISTRY: registry.westgate.pw
@@ -29,9 +30,9 @@ jobs:
       - name: Build OCI image (daemonless)
         run: nix build .#image
 
-      # Publish only on main (post-merge). PRs verify the build but never push.
+      # Publish only on a v* tag push. PRs and main pushes build but never push.
       - name: Publish image
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}