diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index 977be67d4e8..1cf4e6b5da7 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -18,7 +18,7 @@ jobs:
   # Each time this workflow is executed, a build will be triggered to create a new image
   # with the corresponding tags using information from git
 
-  # The image will be named `zebra:<semver>.experimental`
+  # The image will be named `zebra:<semver>-experimental`
   build-experimental:
     name: Build Experimental Features Release Docker
     uses: ./.github/workflows/sub-build-docker-image.yml
@@ -26,7 +26,7 @@ jobs:
       dockerfile_path: ./docker/Dockerfile
       dockerfile_target: runtime
       image_name: zebra
-      tag_suffix: .experimental
+      tag_suffix: -experimental
       features: ${{ format('{0} {1}', vars.RUST_PROD_FEATURES, vars.RUST_EXPERIMENTAL_FEATURES) }}
       rust_log: ${{ vars.RUST_LOG }}
     # This step needs access to Docker Hub secrets to run successfully
diff --git a/.github/workflows/sub-build-docker-image.yml b/.github/workflows/sub-build-docker-image.yml
index 3a202991ed5..e804158cd12 100644
--- a/.github/workflows/sub-build-docker-image.yml
+++ b/.github/workflows/sub-build-docker-image.yml
@@ -103,23 +103,14 @@ jobs:
           tags: |
             # These DockerHub release tags support the following use cases:
             # - `latest`: always use the latest Zebra release when you pull or update
-            # - `1`: use the latest Zebra release, but require manual intervention for the next network upgrade
-            # - `1.x`: update to bug fix releases, but don't add any new features or incompatibilities
             # - `v1.x.y` or `1.x.y`: always use the exact version, don't automatically upgrade
-            # - `sha-zzzzzz`: always use the exact commit (the same as `1.x.y`, but also used in CI and production image tests)
-            #
-            # Stopping publishing some tags is a silently breaking change:
-            # - `1`: doesn't get expected new consensus-compatible releases or bug fixes
-            # - `1.x`: doesn't get expected bug fixes
             #
             # `semver` adds a "latest" tag if `inputs.latest_tag` is `true`.
             type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
             type=ref,event=tag
             # DockerHub release and CI tags.
             # This tag makes sure tests are using exactly the right image, even when multiple PRs run at the same time.
-            type=sha
+            type=sha,event=push
             # These CI-only tags support CI on PRs, the main branch, and scheduled full syncs. 
             # These tags do not appear on DockerHub, because DockerHub images are only published on the release event.
             type=ref,event=pr