diff --git a/.github/actions/build-release-image/action.yml b/.github/actions/build-release-image/action.yml
index 0d8e0728..3eafd093 100644
--- a/.github/actions/build-release-image/action.yml
+++ b/.github/actions/build-release-image/action.yml
@@ -18,12 +18,19 @@ outputs:
 runs:
   using: "composite"
   steps:
+    - id: set-image-tag
+      shell: bash
+      run: |
+        # not strictly required as long as the calling workflow has checked out
+        # the repo with the correct ref, but for good measure and making this
+        # composite action not have a hard requirement on the git repo, we can
+        # set the tag to the specified commit hash
+        echo "IMAGE_TAG=${{ inputs.commit_hash }}" >> "$GITHUB_ENV"
 
     - id: get-image-identifier
       shell: bash
       run: |
         IMAGE_NAME=$(make APP_NAME=${{ inputs.app_name }} release-image-name)
-        IMAGE_TAG=$(make release-image-tag)
         echo "image=$IMAGE_NAME:$IMAGE_TAG" >> "$GITHUB_OUTPUT"
 
     - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml
index 20deff9d..e622abd4 100644
--- a/.github/workflows/build-and-publish.yml
+++ b/.github/workflows/build-and-publish.yml
@@ -61,7 +61,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.ref }}
+          ref: ${{ needs.get-commit-hash.outputs.commit_hash }}
 
       - name: Set up Terraform
         uses: ./.github/actions/setup-terraform
diff --git a/.github/workflows/cd-{{app_name}}.yml.jinja b/.github/workflows/cd-{{app_name}}.yml.jinja
index d09dc042..230cd43a 100644
--- a/.github/workflows/cd-{{app_name}}.yml.jinja
+++ b/.github/workflows/cd-{{app_name}}.yml.jinja
@@ -1,7 +1,7 @@
 name: Deploy {{ app_name }}
 # Need to set a default value for when the workflow is triggered from a git push
 # which bypasses the default configuration for inputs
-run-name: Deploy ${{'{{'}}inputs.version || 'main' {{'}}'}} to {{ app_name }} ${{'{{'}} inputs.environment || 'dev' {{'}}'}}
+run-name: Deploy ${{'{{'}} inputs.version || github.sha {{'}}'}} to {{ app_name }} ${{'{{'}} inputs.environment || 'dev' {{'}}'}}
 
 on:
   {% if app_has_dev_env_setup %}
@@ -51,5 +51,5 @@ jobs:
     with:
       app_name: "{{ app_name }}"
       environment: ${{'{{'}} inputs.environment || 'dev' {{'}}'}}
-      version: ${{'{{'}} inputs.version || 'main' {{'}}'}}
+      version: ${{'{{'}} inputs.version || github.sha {{'}}'}}
     secrets: inherit