diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 92da5a94e84..cad6b7ad3c6 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -82,6 +82,7 @@ jobs:
   docker-push:
     name: ${{ matrix.role }} images
     runs-on: ubuntu-latest
+    environment: Production Docker Registry
     needs: matrix_builder
 
     # setup jobs for each role
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index b708d0b973c..3b5620f43c2 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -1,10 +1,18 @@
 name: CD
 
 on:
-  push:
-    tags:
-      - '*'
-      - "!daily-*"
+# Workflow dispatch for now, while we're testing environments
+  # push:
+  #   tags:
+  #     - '*'
+  #     - "!daily-*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag/commit'
+        required: true
+        type: string
+
 
 env:
   GO_VERSION: "1.22"
@@ -13,6 +21,7 @@ jobs:
   docker-push:
     name: Push to container registry
     runs-on: ubuntu-latest
+    environment: Production Docker Registry
     steps:
     - name: Setup Go
       uses: actions/setup-go@v4
@@ -21,6 +30,8 @@ jobs:
         go-version: ${{ env.GO_VERSION }}
     - name: Checkout repo
       uses: actions/checkout@v2
+      with:
+        ref: ${{ inputs.tag }}
     # Provide Google Service Account credentials to Github Action, allowing interaction with the Google Container Registry
     # Logging in as github-actions@dl-flow.iam.gserviceaccount.com
     - id: auth