diff --git a/.github/workflows/podvm.yaml b/.github/workflows/podvm.yaml
index 721a745f6..a970663e8 100644
--- a/.github/workflows/podvm.yaml
+++ b/.github/workflows/podvm.yaml
@@ -6,6 +6,10 @@ on:
         default: 'quay.io/confidential-containers'
         required: false
         type: string
+      image_tag:
+        default: ''
+        required: false
+        type: string
 
 jobs:
   build:
@@ -56,5 +60,6 @@ jobs:
         PUSH: true
         REGISTRY: ${{ inputs.registry }}
         ARCH: ${{ matrix.arch }}
+        PODVM_TAG: ${{ inputs.image_tag }}
         PODVM_DISTRO: ${{ matrix.os }}
         CLOUD_PROVIDER: ${{ matrix.provider }}
diff --git a/.github/workflows/podvm_binaries.yaml b/.github/workflows/podvm_binaries.yaml
index 0b1786c65..852a2b219 100644
--- a/.github/workflows/podvm_binaries.yaml
+++ b/.github/workflows/podvm_binaries.yaml
@@ -6,6 +6,10 @@ on:
         default: 'quay.io/confidential-containers'
         required: false
         type: string
+      image_tag:
+        default: ''
+        required: false
+        type: string
 
 jobs:
   build:
@@ -58,4 +62,5 @@ jobs:
           PUSH: true
           REGISTRY: ${{ inputs.registry }}
           ARCH: ${{ matrix.arch }}
+          PODVM_TAG: ${{ inputs.image_tag }}
           PODVM_DISTRO: ${{ matrix.os }}
diff --git a/.github/workflows/podvm_builder.yaml b/.github/workflows/podvm_builder.yaml
index bf894ec36..a35f81bbd 100644
--- a/.github/workflows/podvm_builder.yaml
+++ b/.github/workflows/podvm_builder.yaml
@@ -6,6 +6,10 @@ on:
         default: 'quay.io/confidential-containers'
         required: false
         type: string
+      image_tag:
+        default: ''
+        required: false
+        type: string
 
 jobs:
   build:
@@ -55,4 +59,5 @@ jobs:
       env:
           PUSH: true
           REGISTRY: ${{ inputs.registry }}
+          PODVM_TAG: ${{ inputs.image_tag }}
           PODVM_DISTRO: ${{ matrix.os }}
diff --git a/Makefile b/Makefile
index 4a5c8b9de..1fcc5d98a 100644
--- a/Makefile
+++ b/Makefile
@@ -191,10 +191,11 @@ endif
 REGISTRY ?= quay.io/confidential-containers
 
 PODVM_DISTRO ?= ubuntu
+PODVM_TAG ?= $(VERSIONS_HASH)
 
-PODVM_BUILDER_IMAGE ?= $(REGISTRY)/podvm-builder-$(PODVM_DISTRO):$(VERSIONS_HASH)
-PODVM_BINARIES_IMAGE ?= $(REGISTRY)/podvm-binaries-$(PODVM_DISTRO)-$(ARCH):$(VERSIONS_HASH)
-PODVM_IMAGE ?= $(REGISTRY)/podvm-$(or $(CLOUD_PROVIDER),generic)-$(PODVM_DISTRO)-$(ARCH):$(VERSIONS_HASH)
+PODVM_BUILDER_IMAGE ?= $(REGISTRY)/podvm-builder-$(PODVM_DISTRO):$(PODVM_TAG)
+PODVM_BINARIES_IMAGE ?= $(REGISTRY)/podvm-binaries-$(PODVM_DISTRO)-$(ARCH):$(PODVM_TAG)
+PODVM_IMAGE ?= $(REGISTRY)/podvm-$(or $(CLOUD_PROVIDER),generic)-$(PODVM_DISTRO)-$(ARCH):$(PODVM_TAG)
 
 PUSH ?= false
 # If not pushing `--load` into the local docker cache