diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 01d556be072..6eb3f2b4fbd 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -169,9 +169,15 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
+            # `latest` and `v*` are release pointers. Gate them off for manual
+            # (workflow_dispatch) runs — even one dispatched from master — so a
+            # preview build can never move `latest` or mint a release tag. The
+            # explicit default-branch check replaces `{{is_default_branch}}`,
+            # which is also true on a dispatch from master and would otherwise
+            # leak `latest` onto a preview image.
+            type=raw,value=latest,enable=${{ github.ref_name == github.event.repository.default_branch && github.event_name != 'workflow_dispatch' }}
+            type=semver,pattern={{version}},enable=${{ github.event_name != 'workflow_dispatch' }}
+            type=semver,pattern={{major}}.{{minor}},enable=${{ github.event_name != 'workflow_dispatch' }}
             # push/tag builds keep the stock sha tag (sha-<short> of github.sha).
             # A manual run may build a ref other than github.sha, so it tags the
             # resolved commit instead — same sha-<short> format, correct commit.
@@ -353,9 +359,15 @@ jobs:
           flavor: |
             suffix=-cloud,onlatest=true
           tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
+            # `latest` and `v*` are release pointers. Gate them off for manual
+            # (workflow_dispatch) runs — even one dispatched from master — so a
+            # preview build can never move `latest` or mint a release tag. The
+            # explicit default-branch check replaces `{{is_default_branch}}`,
+            # which is also true on a dispatch from master and would otherwise
+            # leak `latest` onto a preview image.
+            type=raw,value=latest,enable=${{ github.ref_name == github.event.repository.default_branch && github.event_name != 'workflow_dispatch' }}
+            type=semver,pattern={{version}},enable=${{ github.event_name != 'workflow_dispatch' }}
+            type=semver,pattern={{major}}.{{minor}},enable=${{ github.event_name != 'workflow_dispatch' }}
             # push/tag builds keep the stock sha tag (sha-<short> of github.sha).
             # A manual run may build a ref other than github.sha, so it tags the
             # resolved commit instead — same sha-<short> format, correct commit.