diff --git a/.github/workflows/docker-build-push-ecr.yml b/.github/workflows/docker-build-push-ecr.yml
index 509905a..0c87108 100644
--- a/.github/workflows/docker-build-push-ecr.yml
+++ b/.github/workflows/docker-build-push-ecr.yml
@@ -46,6 +46,11 @@ on:
         required: false
         type: string
         default: ''
+      ref:
+        description: 'Git ref to check out and build (tag/branch/SHA). Empty = the commit that triggered the run. Pass the tag being published whenever the run context is not the tag itself (e.g. chained release pipelines running on main).'
+        required: false
+        type: string
+        default: ''
     outputs:
       image_digest:
         description: 'OCI image-index digest (sha256:...)'
@@ -75,6 +80,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          # Empty ref = actions/checkout default (the triggering commit).
+          ref: ${{ inputs.ref }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
diff --git a/.github/workflows/release-publish-oci.yml b/.github/workflows/release-publish-oci.yml
index 0ec79d7..850b0cd 100644
--- a/.github/workflows/release-publish-oci.yml
+++ b/.github/workflows/release-publish-oci.yml
@@ -196,6 +196,11 @@ jobs:
       build_args: ${{ inputs.build_args }}
       also_tag_latest: ${{ inputs.also_tag_latest }}
       tag: ${{ inputs.existing_tag || needs.release.outputs.tag_name }}
+      # Build the TAG's code, not the run's checkout. The run always sits on
+      # the main branch (that is what makes the chain trigger at all), which
+      # coincides with the tagged commit for a fresh release — but never for
+      # an existing_tag recovery/backfill, where main has moved on.
+      ref: ${{ inputs.existing_tag || needs.release.outputs.tag_name }}
     secrets:
       aws_role_arn: ${{ secrets.aws_role_arn }}