diff --git a/.github/workflows/build-healthchat.yaml b/.github/workflows/build-healthchat.yaml
index b754ebf0dd..6a63c845ce 100644
--- a/.github/workflows/build-healthchat.yaml
+++ b/.github/workflows/build-healthchat.yaml
@@ -62,7 +62,17 @@ jobs:
                     exit 1
                   fi
                   echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-                  echo "Resolved version: $VERSION"
+                  # `:latest` is what the ansible inventory deploys from, so only a clean
+                  # X.Y.Z tag push may move it — never an -rc/-hotfix/-dryrun tag, and never
+                  # a manual re-run. Otherwise a release candidate or a pipeline test would
+                  # become production on the next deploy of any kind.
+                  if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ && "$GITHUB_EVENT_NAME" == "push" ]]; then
+                    IS_STABLE=true
+                  else
+                    IS_STABLE=false
+                  fi
+                  echo "is_stable=$IS_STABLE" >> "$GITHUB_OUTPUT"
+                  echo "Resolved version: $VERSION (moves :latest: $IS_STABLE)"
 
             - name: Resolve workspace ref
               id: workspace
@@ -157,7 +167,7 @@ jobs:
                   images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE }}
                   tags: |
                       type=raw,value=${{ steps.version.outputs.version }}
-                      type=raw,value=stable
+                      type=raw,value=latest,enable=${{ steps.version.outputs.is_stable == 'true' }}
                       type=raw,value=${{ github.sha }}
 
             - name: Set up Docker Buildx