diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0edbf5a..eccba2d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,8 +4,6 @@ name: publish
 on:
   workflow_dispatch:
   push:
-    branches:
-      - main
     tags:
       - "v*"
 permissions:
@@ -25,19 +23,15 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Push versioned tag
-        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        run: nix run .#push -- "v$(cat version.txt)"
-      - name: Push latest tag (main only)
-        if: github.ref == 'refs/heads/main'
-        run: nix run .#push -- latest
       - name: Render manifest and publish release
         if: startsWith(github.ref, 'refs/tags/v')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          ref=$(nix run .#push -- "${{ github.ref_name }}")
+          nix run .#push -- latest > /dev/null
           out="$RUNNER_TEMP/collateral-proxy.yml"
-          nix run .#render-k8s-resources > "$out"
+          nix run .#render-k8s-resources -- "$ref" > "$out"
           gh release create "${{ github.ref_name }}" \
             --title "${{ github.ref_name }}" \
             --generate-notes \
diff --git a/README.md b/README.md
index 02d4a94..272f702 100644
--- a/README.md
+++ b/README.md
@@ -107,7 +107,7 @@ The proxy preserves the path and query and rewrites only the host, so clients on
 - Build the binary: `nix build .#collateral-proxy`.
 - Build the container image: `nix build .#container`.
 - Push the image: `nix run .#push -- [tag]` (defaults to the `:dev`).
-- Push the image and render the pinned deployment manifest: `nix run .#render-k8s-resources -- [tag]`.
+- Render the deployment manifest pinned to a pushed image: `nix run .#render-k8s-resources -- "$(nix run .#push -- dev)"`.
 - Format: `nix fmt`.
 - Lint: `nix run .#lint`.
 - Vuln scan: `nix run .#govulncheck`.
@@ -125,6 +125,4 @@ The proxy preserves the path and query and rewrites only the host, so clients on
 
 3. Open a PR and merge to `main`.
 
-4. CI running on main publishes `ghcr.io/edgelesssys/collateral-proxy:v0.X.0` and moves `:latest`.
-
-5. Push the `v0.X.0` tag. CI then publishes a GitHub Release and attaches `collateral-proxy.yaml`, the deployment manifest pinned to `v0.X.0@sha256:<digest>`.
+4. Push the `v0.X.0` tag. CI then publishes `ghcr.io/edgelesssys/collateral-proxy:v0.X.0`, moves `:latest`, and creates a GitHub Release with `collateral-proxy.yaml` attached.
diff --git a/flake.nix b/flake.nix
index a8d60c3..fda0cd9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -91,23 +91,25 @@
           '';
         };
 
-        # Push the image and render the deployment manifest to stdout.
+        # Render the deployment manifest to stdout.
         render-k8s-resources = pkgs.writeShellApplication {
           name = "render-k8s-resources";
           runtimeInputs = [
-            push
             pkgs.gnugrep
             pkgs.gnused
           ];
           text = ''
             trap 'echo "render-k8s-resources: failed (exit $?) at line $LINENO: $BASH_COMMAND" >&2' ERR
-            tag="''${1:-v${version}}"
+            if [[ $# -ne 1 ]]; then
+              echo "usage: render-k8s-resources ${image}:<tag>@sha256:<digest>" >&2
+              exit 1
+            fi
+            ref=$1
             template=${./collateral-proxy.yml}
             if ! grep -q '%%pin%%' "$template"; then
               echo "render-k8s-resources: template $template is missing the %%pin%% placeholder" >&2
               exit 1
             fi
-            ref=$(push-collateral-proxy "$tag")
             sed "s|%%pin%%|$ref|" "$template"
           '';
         };