diff --git a/.github/workflows/sunnypilot-build-prebuilt.yaml b/.github/workflows/sunnypilot-build-prebuilt.yaml
index 344a49e93a..d654f5ab46 100644
--- a/.github/workflows/sunnypilot-build-prebuilt.yaml
+++ b/.github/workflows/sunnypilot-build-prebuilt.yaml
@@ -16,7 +16,7 @@ env:
 on:
   push:
     branches: [ master, master-dev-c3-new ]
-    tags: [ '*' ]
+    tags: [ 'release/*' ]
   pull_request_target:
     types: [ labeled ]
   workflow_dispatch:
@@ -38,6 +38,8 @@ jobs:
       version: ${{ steps.strategy.outputs.version }}
       cancel_publish_in_progress: ${{ steps.strategy.outputs.cancel_publish_in_progress }}
       publish_concurrency_group: ${{ steps.strategy.outputs.publish_concurrency_group }}
+      is_stable_branch: ${{ steps.strategy.outputs.is_stable_branch }}
+      build: ${{ steps.strategy.outputs.build }}
     steps:
       - uses: actions/checkout@v4
       - name: Extract deploy strategy
@@ -52,18 +54,19 @@ jobs:
             .configs[] | select(.branch == $branch)
           ')
 
+          BUILD="$(date '+%Y.%m.%d')-${{ github.run_number }}"
           if [[ -z "$CONFIG" || "$CONFIG" == "null" ]]; then
             echo "No exact strategy match found. Falling back to feature/fork logic."
             IS_FORK="${{ github.event.pull_request.head.repo.fork && 'true' || 'false' }}"
             FORK_SUFFIX=$( [[ "$IS_FORK" == "true" ]] && echo "-fork" || echo "" )
             NEW_BRANCH="${BRANCH}${FORK_SUFFIX}-prebuilt"
-            VERSION="$(date '+%Y.%m.%d')-${{ github.run_number }}"
 
-            echo "environment=${{ (contains(fromJSON(vars.AUTO_DEPLOY_PREBUILT_BRANCHES), github.head_ref || github.ref_name) || contains(github.event.pull_request.labels.*.name, 'prebuilt')) && 'auto-deploy' || 'feature-branch' }}" >> $GITHUB_OUTPUT
             echo "new_branch=$NEW_BRANCH" >> $GITHUB_OUTPUT
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
+            echo "version=$BUILD" >> $GITHUB_OUTPUT
             echo "cancel_publish_in_progress=true" >> $GITHUB_OUTPUT
             echo "publish_concurrency_group=publish-${BRANCH}" >> $GITHUB_OUTPUT
+            echo "environment=feature-branch" >> $GITHUB_OUTPUT
+            echo "extra_version_identifier=feature-branch" >> $GITHUB_OUTPUT
           else
           echo "Matched config: $CONFIG"
             environment=$(echo "$CONFIG" | jq -r '.environment')
@@ -73,19 +76,24 @@ jobs:
             echo "cancel_publish_in_progress=$( [ "$cancel" = "null" ] && echo "true" || echo $cancel)" >> $GITHUB_OUTPUT
             echo "publish_concurrency_group=publish-${BRANCH}$( [ "$cancel" = "null" ] || [ "$cancel" = "true" ] || echo "${{ github.sha }}" )" >> $GITHUB_OUTPUT
           
-            stable_branch="$(echo "$CONFIG" | jq -r '.stable_branch // false')";
+            is_stable_branch="$(echo "$CONFIG" | jq -r '.stable_branch // false')";
+            echo "is_stable_branch=$is_stable_branch" >> $GITHUB_OUTPUT
+
             stable_version=$(cat common/version.h | grep COMMA_VERSION | sed -e 's/[^0-9|.]//g');
-            unstable_version=$(date '+%Y.%m.%d')-${{ github.run_number }};
-            echo "version=$([ "$stable_branch" = "true" ] && echo "$stable_version" || echo "$unstable_version")" >> $GITHUB_OUTPUT
-            
-            extra_version_identifier=$( [ "$stable_branch" = "true" ] && echo "-${environment}" || echo "" );
-            echo "extra_version_identifier=$extra_version_identifier" >> $GITHUB_OUTPUT
+            echo "version=$([ "$is_stable_branch" = "true" ] && echo "$stable_version" || echo "$BUILD")" >> $GITHUB_OUTPUT
+            echo "extra_version_identifier=${environment}" >> $GITHUB_OUTPUT
           fi
+          echo "build=$BUILD" >> $GITHUB_OUTPUT
           cat $GITHUB_OUTPUT
   
   validate_tests:
     runs-on: ubuntu-24.04
-    if: ((github.event_name == 'workflow_dispatch' && inputs.wait_for_tests) || contains(github.event_name, 'pull_request') && (github.event.action == 'labeled' && github.event.label.name == 'prebuilt'))
+    needs: [ prepare_strategy ]
+    if: ${{
+      ((github.event_name == 'workflow_dispatch' && inputs.wait_for_tests) ||
+      (github.event_name == 'push' && needs.prepare_strategy.outputs.is_stable_branch == 'true') ||
+      contains(github.event_name, 'pull_request') && (github.event.action == 'labeled' && github.event.label.name == 'prebuilt'))
+      }}
     steps:
       - uses: actions/checkout@v4
       - name: Wait for Tests
@@ -93,6 +101,7 @@ jobs:
         with:
           workflow: selfdrive_tests.yaml # The workflow file to monitor
           github-token: ${{ secrets.GITHUB_TOKEN }}
+          should-wait-for-start: ${{ github.event_name == 'push' && 'true' || 'false' }}
 
   build:
     needs: [ validate_tests, prepare_strategy ]
@@ -276,7 +285,7 @@ jobs:
             "${{ needs.build.outputs.new_branch }}" \
             "${{ needs.build.outputs.version }}" \
             "https://x-access-token:${{github.token}}@github.com/sunnypilot/sunnypilot.git" \
-            "-${{ needs.build.outputs.extra_version_identifier }}"
+            "${{ needs.build.outputs.extra_version_identifier }}"
 
           echo ""
           echo "----   ℹ️ To update the list of branches that auto deploy prebuilts  -----"
@@ -284,6 +293,13 @@ jobs:
           echo "1. Go to: ${{ github.server_url }}/${{ github.repository }}/settings/variables/actions/AUTO_DEPLOY_PREBUILT_BRANCHES"
           echo "2. Current value: ${{ vars.AUTO_DEPLOY_PREBUILT_BRANCHES }}"
           echo "3. Update as needed (JSON array with no spaces)"
+      
+      - name: Tag ${{ needs.prepare_strategy.outputs.environment }}
+        if: ${{ needs.prepare_strategy.outputs.is_stable_branch == 'true' && (github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/')) }}
+        run: |
+            TAG="${{ needs.prepare_strategy.outputs.environment }}/${{ needs.prepare_strategy.outputs.version }}/${{ needs.prepare_strategy.outputs.build }}"
+            git tag -f -a ${TAG} -m "${{ needs.prepare_strategy.outputs.environment }} @ ${{ needs.prepare_strategy.outputs.version }} of build ${{ needs.build.outputs.build }}."
+            git push -f origin ${TAG}
 
   notify:
     needs: [ build, publish ]
diff --git a/release/ci/publish.sh b/release/ci/publish.sh
index d723782934..4aecbacc4a 100755
--- a/release/ci/publish.sh
+++ b/release/ci/publish.sh
@@ -51,26 +51,19 @@ git fetch origin $DEV_BRANCH || (git checkout -b $DEV_BRANCH && git commit --all
 
 echo "[-] committing version $VERSION T=$SECONDS"
 git add -f .
-git commit -a -m "sunnypilot v$VERSION release"
-git branch --set-upstream-to=origin/$DEV_BRANCH
 
 # include source commit hash and build date in commit
 GIT_HASH=$(git --git-dir=$SOURCE_DIR/.git rev-parse HEAD)
 DATETIME=$(date '+%Y-%m-%dT%H:%M:%S')
-SP_VERSION=$(cat $SOURCE_DIR/common/version.h | awk -F\" '{print $2}')
+SP_VERSION=$(awk -F\" '{print $2}' $SOURCE_DIR/common/version.h)
 
-# Add built files to git
-git add -f .
-if [ "$EXTRA_VERSION_IDENTIFIER" = "-release" ] || [ "$EXTRA_VERSION_IDENTIFIER" = "-staging" ]; then
-  export VERSION=${VERSION%"$EXTRA_VERSION_IDENTIFIER"}
-  git commit --amend -m "sunnypilot v$VERSION"
-else
-  git commit --amend -m "sunnypilot v$VERSION
-  version: sunnypilot v$SP_VERSION release
-  date: $DATETIME
-  master commit: $GIT_HASH
-  "
-fi
+# Commit with detailed message
+git commit -a -m "sunnypilot v$VERSION
+version: sunnypilot v$SP_VERSION (${EXTRA_VERSION_IDENTIFIER})
+date: $DATETIME
+master commit: $GIT_HASH
+"
+git branch --set-upstream-to=origin/$DEV_BRANCH
 git branch -m $DEV_BRANCH
 
 # Push!