diff --git a/.github/workflows/build_airflow.yaml b/.github/workflows/build_airflow.yaml
index 5b5e62730..481b1e499 100644
--- a/.github/workflows/build_airflow.yaml
+++ b/.github/workflows/build_airflow.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -31,8 +36,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,7 +91,9 @@ jobs:
       contents: read
     with:
       product-name: airflow
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_druid.yaml b/.github/workflows/build_druid.yaml
index afbf17418..d8f81a633 100644
--- a/.github/workflows/build_druid.yaml
+++ b/.github/workflows/build_druid.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: druid
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_hadoop.yaml b/.github/workflows/build_hadoop.yaml
index e20c598f7..80a8d48c9 100644
--- a/.github/workflows/build_hadoop.yaml
+++ b/.github/workflows/build_hadoop.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: hadoop
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_hbase.yaml b/.github/workflows/build_hbase.yaml
index 8d8ba87e9..04833161f 100644
--- a/.github/workflows/build_hbase.yaml
+++ b/.github/workflows/build_hbase.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,7 +94,9 @@ jobs:
       contents: read
     with:
       product-name: hbase
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_hive.yaml b/.github/workflows/build_hive.yaml
index cd0b31c60..d9e3bc53d 100644
--- a/.github/workflows/build_hive.yaml
+++ b/.github/workflows/build_hive.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,8 +94,10 @@ jobs:
       contents: read
     with:
       product-name: hive
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_java-base.yaml b/.github/workflows/build_java-base.yaml
index 6a6d1d838..d99777efe 100644
--- a/.github/workflows/build_java-base.yaml
+++ b/.github/workflows/build_java-base.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -41,7 +89,9 @@ jobs:
       contents: read
     with:
       product-name: java-base
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_java-devel.yaml b/.github/workflows/build_java-devel.yaml
index 23b6bfa88..583be886f 100644
--- a/.github/workflows/build_java-devel.yaml
+++ b/.github/workflows/build_java-devel.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -41,7 +89,9 @@ jobs:
       contents: read
     with:
       product-name: java-devel
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_kafka-testing-tools.yaml b/.github/workflows/build_kafka-testing-tools.yaml
index 1c9692fcc..a61af127f 100644
--- a/.github/workflows/build_kafka-testing-tools.yaml
+++ b/.github/workflows/build_kafka-testing-tools.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: kafka-testing-tools
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_kafka.yaml b/.github/workflows/build_kafka.yaml
index a0c06e7af..a1b036522 100644
--- a/.github/workflows/build_kafka.yaml
+++ b/.github/workflows/build_kafka.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,7 +94,9 @@ jobs:
       contents: read
     with:
       product-name: kafka
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index c8322ef55..7a4f693b2 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -20,7 +25,7 @@ on:
       - "[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+"
     paths:
       # To check dependencies, run this ( you will need to consider transitive dependencies)
-      # bake --product PRODUCT -d | grep -v 'docker buildx bake' | jq '.target | keys[]'
+      # boil build PRODUCT -d | jq '.target | keys[]' | grep -v 'common--target'
       - krb5/**
       - .github/actions/**
       - .github/workflows/build_krb5.yaml
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -41,7 +89,9 @@ jobs:
       contents: read
     with:
       product-name: krb5
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_nifi.yaml b/.github/workflows/build_nifi.yaml
index 8e46aae84..f6db301cb 100644
--- a/.github/workflows/build_nifi.yaml
+++ b/.github/workflows/build_nifi.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,10 +93,12 @@ jobs:
       contents: read
     with:
       product-name: nifi
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       # Since building Vector from source, this build runs out of disk space.
       # As such, we use the Ubicloud runners which provide bigger disks.
       runners: ubicloud
diff --git a/.github/workflows/build_omid.yaml b/.github/workflows/build_omid.yaml
index 8d1dfb49c..86927555c 100644
--- a/.github/workflows/build_omid.yaml
+++ b/.github/workflows/build_omid.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: omid
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_opa.yaml b/.github/workflows/build_opa.yaml
index f8efdbec4..1e5e0b81d 100644
--- a/.github/workflows/build_opa.yaml
+++ b/.github/workflows/build_opa.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -31,8 +36,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,7 +91,9 @@ jobs:
       contents: read
     with:
       product-name: opa
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_opensearch.yaml b/.github/workflows/build_opensearch.yaml
index 8cbcd506f..359bcae8f 100644
--- a/.github/workflows/build_opensearch.yaml
+++ b/.github/workflows/build_opensearch.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,8 +94,10 @@ jobs:
       contents: read
     with:
       product-name: opensearch
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_opensearch_dashboards.yaml b/.github/workflows/build_opensearch_dashboards.yaml
index 64f066228..29c495de5 100644
--- a/.github/workflows/build_opensearch_dashboards.yaml
+++ b/.github/workflows/build_opensearch_dashboards.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -32,8 +37,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -44,8 +92,10 @@ jobs:
       contents: read
     with:
       product-name: opensearch-dashboards
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_spark-connect-client.yaml b/.github/workflows/build_spark-connect-client.yaml
index 20b3d649b..7db27ab23 100644
--- a/.github/workflows/build_spark-connect-client.yaml
+++ b/.github/workflows/build_spark-connect-client.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -32,8 +37,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,11 +91,13 @@ jobs:
       contents: read
     with:
       product-name: spark-connect-client
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: stackable
       # Since building Vector from source, this build runs out of disk space.
       # As such, we use the Ubicloud runners which provide bigger disks.
       runners: ubicloud
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       publish-to-quay: false
diff --git a/.github/workflows/build_spark-k8s.yaml b/.github/workflows/build_spark-k8s.yaml
index 45cd9cd95..1ad8993ce 100644
--- a/.github/workflows/build_spark-k8s.yaml
+++ b/.github/workflows/build_spark-k8s.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,8 +94,10 @@ jobs:
       contents: read
     with:
       product-name: spark-k8s
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_stackable-base.yaml b/.github/workflows/build_stackable-base.yaml
index e73f1252e..c7e5bd29c 100644
--- a/.github/workflows/build_stackable-base.yaml
+++ b/.github/workflows/build_stackable-base.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -30,8 +35,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -42,7 +90,9 @@ jobs:
       contents: read
     with:
       product-name: stackable-base
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_superset.yaml b/.github/workflows/build_superset.yaml
index 6123510d9..9d4f8b0fb 100644
--- a/.github/workflows/build_superset.yaml
+++ b/.github/workflows/build_superset.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -31,8 +36,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,7 +91,9 @@ jobs:
       contents: read
     with:
       product-name: superset
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_testing-tools.yaml b/.github/workflows/build_testing-tools.yaml
index 1793eeab1..764aebf8a 100644
--- a/.github/workflows/build_testing-tools.yaml
+++ b/.github/workflows/build_testing-tools.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow (${{ matrix.product-name }})
+    name: Build Image(s) (${{ matrix.product-name }})
+    needs: [defaults]
     strategy:
       fail-fast: false
       matrix:
@@ -49,7 +97,9 @@ jobs:
       contents: read
     with:
       product-name: ${{ matrix.product-name }}
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_tools.yaml b/.github/workflows/build_tools.yaml
index c68762747..0b1914a18 100644
--- a/.github/workflows/build_tools.yaml
+++ b/.github/workflows/build_tools.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -30,8 +35,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -42,7 +90,9 @@ jobs:
       contents: read
     with:
       product-name: tools
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_trino-cli.yaml b/.github/workflows/build_trino-cli.yaml
index 5dc3260a1..3bcf0fe8b 100644
--- a/.github/workflows/build_trino-cli.yaml
+++ b/.github/workflows/build_trino-cli.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -32,8 +37,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -44,7 +92,9 @@ jobs:
       contents: read
     with:
       product-name: trino-cli
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_trino.yaml b/.github/workflows/build_trino.yaml
index 0ad8ea84e..0028b2824 100644
--- a/.github/workflows/build_trino.yaml
+++ b/.github/workflows/build_trino.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,10 +93,12 @@ jobs:
       contents: read
     with:
       product-name: trino
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       # Since building Vector from source, this build runs out of disk space.
       # As such, we use the Ubicloud runners which provide bigger disks.
       runners: ubicloud
diff --git a/.github/workflows/build_vector.yaml b/.github/workflows/build_vector.yaml
index a9db48545..57b6c4342 100644
--- a/.github/workflows/build_vector.yaml
+++ b/.github/workflows/build_vector.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -41,7 +89,9 @@ jobs:
       contents: read
     with:
       product-name: vector
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_zookeeper.yaml b/.github/workflows/build_zookeeper.yaml
index f4b62939f..a76e11c92 100644
--- a/.github/workflows/build_zookeeper.yaml
+++ b/.github/workflows/build_zookeeper.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: zookeeper
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml
index 9c373e0af..92cdd20f7 100644
--- a/.github/workflows/reusable_build_image.yaml
+++ b/.github/workflows/reusable_build_image.yaml
@@ -36,6 +36,11 @@ on:
           provided.
         type: boolean
         default: true
+      floating-tag:
+        description: Whether to produce a floating tag
+        type: boolean
+        # NOTE (@Techassi): Default to false for now, but eventually we want to default to true here
+        default: false
     secrets:
       harbor-robot-secret:
         description: The secret for the Harbor robot user used to push images and manifest
@@ -125,6 +130,8 @@ jobs:
           product-name: ${{ inputs.product-name }}
           product-version: ${{ matrix.versions }}
           sdp-version: ${{ inputs.sdp-version }}
+          # Map the boolean to a string, because actions cannot use boolean inputs.
+          floating-tag: ${{ case(inputs.floating-tag, 'true', 'false') }}
 
       - name: Publish Container Image on oci.stackable.tech
         if: inputs.publish
@@ -141,6 +148,7 @@ jobs:
           image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-manifest-tag: ${{ steps.build.outputs.canonical-image-manifest-tag }}
           canonical-source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.canonical-image-manifest-tag }}
+          other-image-manifest-tags: ${{ steps.build.outputs.other-image-manifest-tags }}
 
       - name: Publish Container Image on quay.io
         if: inputs.publish && inputs.publish-to-quay
@@ -157,6 +165,7 @@ jobs:
           image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-manifest-tag: ${{ steps.build.outputs.canonical-image-manifest-tag }}
           canonical-source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.canonical-image-manifest-tag }}
+          other-image-manifest-tags: ${{ steps.build.outputs.other-image-manifest-tags }}
 
   publish_manifests:
     name: Build/Publish ${{ matrix.versions }} Manifests
@@ -175,6 +184,29 @@ jobs:
         with:
           persist-credentials: false
 
+      # NOTE (@Techassi): I'm not super happy about how this looks/works, but as already mentioned,
+      # this should only be a stepping stone towards a more robust solution.
+      - name: Install boil
+        if: inputs.floating-tag
+        uses: stackabletech/actions/setup-tools@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
+        with:
+          boil-version: latest
+
+      - name: Extract floating image index manifest tag
+        id: extract-floating-tag
+        if: inputs.floating-tag
+        env:
+          SDP_VERSION: ${{ inputs.sdp-version }}
+          IMAGE_VERSION: ${{ matrix.versions }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          FLOATING_IMAGE_INDEX_MANIFEST_TAG=$(boil tools floating-tag "${SDP_VERSION}")
+          FLOATING_IMAGE_INDEX_MANIFEST_TAG="${IMAGE_VERSION}-stackable${FLOATING_IMAGE_INDEX_MANIFEST_TAG}"
+
+          echo "FLOATING_IMAGE_INDEX_MANIFEST_TAG=[\"$FLOATING_IMAGE_INDEX_MANIFEST_TAG\"]" | tee -a "$GITHUB_OUTPUT"
+
       - name: Publish and Sign Image Index Manifest to oci.stackable.tech
         id: publish-oci
         if: inputs.publish
@@ -190,6 +222,7 @@ jobs:
           # registry so we don't have to do such gymnastics in the workflow.
           image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}
+          other-image-index-manifest-tags: ${{ case(inputs.floating-tag, steps.extract-floating-tag.outputs.FLOATING_IMAGE_INDEX_MANIFEST_TAG, '[]') }}
 
       - name: Publish and Sign Image Index Manifest to quay.io
         id: publish-quay
@@ -206,6 +239,7 @@ jobs:
           # registry so we don't have to do such gymnastics in the workflow.
           image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}
+          other-image-index-manifest-tags: ${{ case(inputs.floating-tag, steps.extract-floating-tag.outputs.FLOATING_IMAGE_INDEX_MANIFEST_TAG, '[]') }}
 
   notify:
     name: Failure Notification
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c6a93ec6f..ab3b2403c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,7 +43,7 @@ repos:
       - id: ruff-format
 
   - repo: https://github.com/rhysd/actionlint
-    rev: e7d448ef7507c20fc4c88a95d0c448b848cd6127 # 1.7.8
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # 1.7.12
     hooks:
       - id: actionlint