diff --git a/build/ci/cloudbuild.push_cdc_stable.yaml b/build/ci/cloudbuild.push_cdc_stable.yaml
new file mode 100644
index 0000000000..6795aee5ac
--- /dev/null
+++ b/build/ci/cloudbuild.push_cdc_stable.yaml
@@ -0,0 +1,70 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Updates stable-tagged Docker images for custom DC.
+# Assumes the stable branch is already checked out, which it should be
+# if this is triggered on push to branch for the stable branch.
+
+steps:
+  # Step 0: Initialize submods
+  - id: init-submods
+    name: gcr.io/cloud-builders/git
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        git submodule update --init --recursive
+    waitFor: ["-"]
+
+  # Step 1: Get a label that combines commit hashes.
+  - id: get-label
+    name: gcr.io/cloud-builders/git
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        ./scripts/get_commits_label.sh | tail -1 >"$_IMAGE_LABEL_PATH"
+    waitFor: ["init-submods"]
+
+  # Step 1: Services container
+  - id: build-and-tag-stable-services
+    name: gcr.io/datcom-ci/deploy-tool
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        image_label=$(cat "$_IMAGE_LABEL_PATH")
+        ./scripts/build_cdc_services_and_tag_stable.sh $image_label
+    waitFor: ["get-label"]
+
+  # Step 2: Data management container
+  - id: build-and-tag-stable-data
+    name: gcr.io/datcom-ci/deploy-tool
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        set -e
+        image_label=$(cat "$_IMAGE_LABEL_PATH")
+        ./scripts/build_cdc_data_and_tag_stable.sh $image_label
+    waitFor: ["get-label"]
+
+substitutions:
+  _IMAGE_LABEL_PATH: "/workspace/tmp_cdc_stable_image_label.txt"
+
+options:
+  machineType: "E2_HIGHCPU_32"
diff --git a/scripts/get_commits_label.sh b/scripts/get_commits_label.sh
new file mode 100644
index 0000000000..404df5c9c7
--- /dev/null
+++ b/scripts/get_commits_label.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Make a label for container images using the combined commit hash of website
+# and its submods.
+
+# Optionally use the commit before HEAD for the main repo.
+if [[ "$1" == "--head-is-temporary" ]]; then
+  website_rev="$(git rev-parse --short HEAD~1)"
+else
+  website_rev="$(git rev-parse --short HEAD)"
+fi
+mixer_rev="$(git rev-parse --short HEAD:mixer)"
+import_rev="$(git rev-parse --short HEAD:import)"
+image_label="${website_rev}-${mixer_rev}-${import_rev}"
+
+echo "$image_label"
diff --git a/scripts/update_submods_for_cdc_autopush.sh b/scripts/update_submods_for_cdc_autopush.sh
index 02e79f1405..9f55546a95 100755
--- a/scripts/update_submods_for_cdc_autopush.sh
+++ b/scripts/update_submods_for_cdc_autopush.sh
@@ -23,9 +23,6 @@
 set -e
 set -x
 
-# Get the website short commit hash before it changes due to a temp commit.
-website_rev="$(git rev-parse --short HEAD)"
-
 # Initialize all submodules, then merge them with their masters and update
 # their pinned versions (locally only).
 ./scripts/update_git_submodules.sh
@@ -36,8 +33,4 @@ git config user.email "$(gcloud auth list --filter=status:ACTIVE --format='value
 
 git commit --allow-empty -am "DO NOT PUSH: Temp commit to update pinned submod versions (empty if submods are already up-to-date)"
 
-mixer_rev="$(git rev-parse --short HEAD:mixer)"
-import_rev="$(git rev-parse --short HEAD:import)"
-image_label="${website_rev}-${mixer_rev}-${import_rev}"
-
-echo "$image_label"
+./scripts/get_commits_label.sh --head-is-temporary