diff --git a/.github/workflows/build-push-docker.yml b/.github/workflows/build-push-docker.yml
index 4e98249..a38e43a 100644
--- a/.github/workflows/build-push-docker.yml
+++ b/.github/workflows/build-push-docker.yml
@@ -20,23 +20,23 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download binaries
         run: bash downloadBinaries.sh
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: localstack/localstack-docker-desktop
           tags: |
@@ -46,7 +46,7 @@ jobs:
             type=sha
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: "./Dockerfile"
diff --git a/.github/workflows/security-rebuild.yml b/.github/workflows/security-rebuild.yml
index dc51203..80beef7 100644
--- a/.github/workflows/security-rebuild.yml
+++ b/.github/workflows/security-rebuild.yml
@@ -147,23 +147,33 @@ jobs:
 
       - name: Publish (multi-arch)
         # Published here rather than via build-push-docker.yml: GITHUB_TOKEN pushes don't trigger workflows.
+        # v${NEW} is what the secops scan resolves; latest is what docker pull and the marketplace read.
         if: steps.delta.outputs.cleared == 'true' && !inputs.dry_run
         env:
           NEW: ${{ steps.bump.outputs.version }}
         run: |
-          echo "Publishing ${PUBLISHED_IMAGE}:${NEW}, clearing:"; cat cleared.txt
+          echo "Publishing ${PUBLISHED_IMAGE}:${NEW} (also v${NEW}, latest), clearing:"; cat cleared.txt
           docker buildx build --push --pull --no-cache \
             --platform "${PLATFORMS}" \
-            --tag "${PUBLISHED_IMAGE}:${NEW}" .
+            --tag "${PUBLISHED_IMAGE}:${NEW}" \
+            --tag "${PUBLISHED_IMAGE}:v${NEW}" \
+            --tag "${PUBLISHED_IMAGE}:latest" .
 
       # After the publish on purpose: a failed publish must not leave TAG pointing at an unpushed image.
-      - name: Commit and tag
+      - name: Commit, tag and release
         if: steps.delta.outputs.cleared == 'true' && !inputs.dry_run
+        env:
+          NEW: ${{ steps.bump.outputs.version }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           git add Makefile Dockerfile CHANGELOG.md
-          git commit -m "Security rebuild ${{ steps.bump.outputs.version }}"
-          git tag "v${{ steps.bump.outputs.version }}"
-          git push origin HEAD:main "v${{ steps.bump.outputs.version }}"
+          git commit -m "Security rebuild ${NEW}"
+          git tag "v${NEW}"
+          git push origin HEAD:main "v${NEW}"
+
+          # The secops scan reads our GitHub releases, not our tags; a bare tag leaves it on the old version.
+          gh release create "v${NEW}" --title "${NEW}" \
+            --notes "Weekly security rebuild (COSY-926). Cleared: $(paste -sd', ' cleared.txt)."
 
       - name: Summary
         if: always()