diff --git a/.github/actions/determine-docker-image-tag/action.yaml b/.github/actions/determine-docker-image-tag/action.yaml
index fafa5f781d..9354f38698 100644
--- a/.github/actions/determine-docker-image-tag/action.yaml
+++ b/.github/actions/determine-docker-image-tag/action.yaml
@@ -96,9 +96,12 @@ runs:
           fi
         fi
         primary_tag=$(echo ${tags} | awk '{print $1}')
+        secondary_tags=$(echo ${tags} | awk '{$1=""; print substr($0,2)}')
 
         echo "Determined tags: ${tags}"
         echo "Primary tag: ${primary_tag}"
+        echo "Secondary tags: ${secondary_tags}"
 
-        echo "TAGS=${tags}"               >> $GITHUB_OUTPUT
-        echo "PRIMARY_TAG=${primary_tag}" >> $GITHUB_OUTPUT
+        echo "TAGS=${tags}"                     >> $GITHUB_OUTPUT
+        echo "PRIMARY_TAG=${primary_tag}"       >> $GITHUB_OUTPUT
+        echo "SECONDARY_TAGS=${secondary_tags}" >> $GITHUB_OUTPUT
diff --git a/.github/actions/docker-build/action.yaml b/.github/actions/docker-build/action.yaml
index bfa466bd72..9584b4b4d1 100644
--- a/.github/actions/docker-build/action.yaml
+++ b/.github/actions/docker-build/action.yaml
@@ -94,10 +94,8 @@ runs:
       shell: bash
       id: add_extra_tags
       run: |
-        if [[ "${{ github.event_name }}" = "pull_request" || "${{ github.event_name }}" = "pull_request_target" ]]; then
-          extra_tags="-t ${IMAGE_NAME}:${PRIMARY_TAG} -t ${ALTER_IMAGE_NAME}:${PRIMARY_TAG}"
-        else
-          for tag in ${TAGS}; do
+        if [[ "${{ github.event_name }}" != "pull_request" && "${{ github.event_name }}" != "pull_request_target" ]]; then
+          for tag in ${SECONDARY_TAGS}; do
             extra_tags="${extra_tags} -t ${IMAGE_NAME}:${tag} -t ${ALTER_IMAGE_NAME}:${tag}"
           done
         fi
@@ -106,7 +104,7 @@ runs:
       env:
         IMAGE_NAME: ${{ steps.image_name.outputs.IMAGE_NAME }}
         ALTER_IMAGE_NAME: ${{ steps.image_name.outputs.ALTER_IMAGE_NAME }}
-        TAGS: ${{ steps.determine_tag_name.outputs.TAGS }}
+        SECONDARY_TAGS: ${{ steps.determine_tag_name.outputs.SECONDARY_TAGS }}
         PRIMARY_TAG: ${{ steps.determine_tag_name.outputs.PRIMARY_TAG }}
     - name: Build and Push
       shell: bash
diff --git a/Makefile.d/docker.mk b/Makefile.d/docker.mk
index 059faea074..7ecadeb5b7 100644
--- a/Makefile.d/docker.mk
+++ b/Makefile.d/docker.mk
@@ -53,11 +53,11 @@ ifeq ($(REMOTE),true)
 		--build-arg DISTROLESS_IMAGE=$(DISTROLESS_IMAGE) \
 		--build-arg DISTROLESS_IMAGE_TAG=$(DISTROLESS_IMAGE_TAG) \
 		--build-arg MAINTAINER=$(MAINTAINER) \
-		$(EXTRA_ARGS) \
 		--sbom=true \
 		--provenance=mode=max \
 		-t $(CRORG)/$(IMAGE):$(TAG) \
 		-t $(GHCRORG)/$(IMAGE):$(TAG) \
+		$(EXTRA_ARGS) \
 		--output type=registry,oci-mediatypes=true,compression=zstd,compression-level=5,force-compression=true,push=true \
 		-f $(DOCKERFILE) .
 else