From 1fffe0f74dc5ffc8e2740d648469821debba67f3 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 12:38:41 +0200
Subject: [PATCH 01/13] ci: Wire up floating tag support in reusable workflow

---
 .github/workflows/reusable_build_image.yaml | 34 +++++++++++++++++++++
 .pre-commit-config.yaml                     |  2 +-
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml
index 9c373e0af..0b450b4e3 100644
--- a/.github/workflows/reusable_build_image.yaml
+++ b/.github/workflows/reusable_build_image.yaml
@@ -36,6 +36,11 @@ on:
           provided.
         type: boolean
         default: true
+      floating-tag:
+        description: Whether to produce a floating tag
+        type: boolean
+        # NOTE (@Techassi): Default to false for now, but eventually we want to default to true here
+        default: false
     secrets:
       harbor-robot-secret:
         description: The secret for the Harbor robot user used to push images and manifest
@@ -125,6 +130,8 @@ jobs:
           product-name: ${{ inputs.product-name }}
           product-version: ${{ matrix.versions }}
           sdp-version: ${{ inputs.sdp-version }}
+          # Map the boolean to a string, because actions cannot use boolean inputs.
+          floating-tag: ${{ case(inputs.floating-tag, 'true', 'false') }}
 
       - name: Publish Container Image on oci.stackable.tech
         if: inputs.publish
@@ -141,6 +148,7 @@ jobs:
           image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-manifest-tag: ${{ steps.build.outputs.canonical-image-manifest-tag }}
           canonical-source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.canonical-image-manifest-tag }}
+          other-image-manifest-tags: ${{ steps.build.outputs.other-image-manifest-tags }}
 
       - name: Publish Container Image on quay.io
         if: inputs.publish && inputs.publish-to-quay
@@ -157,6 +165,7 @@ jobs:
           image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-manifest-tag: ${{ steps.build.outputs.canonical-image-manifest-tag }}
           canonical-source-image-uri: localhost/${{ inputs.registry-namespace }}/${{ inputs.product-name }}:${{ steps.build.outputs.canonical-image-manifest-tag }}
+          other-image-manifest-tags: ${{ steps.build.outputs.other-image-manifest-tags }}
 
   publish_manifests:
     name: Build/Publish ${{ matrix.versions }} Manifests
@@ -175,6 +184,29 @@ jobs:
         with:
           persist-credentials: false
 
+      # NOTE (@Techassi): I'm not super happy about how this looks/works, but as already mentioned,
+      # this should only be a stepping stone towards a more robust solution.
+      - name: Install boil
+        if: inputs.floating-tag
+        uses: stackabletech/actions/install-tools@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
+        with:
+          boil-version: latest
+
+      - name: Extract floating image index manifest tag
+        id: extract-floating-tag
+        if: inputs.floating-tag
+        env:
+          SDP_VERSION: ${{ inputs.sdp-version }}
+          IMAGE_VERSION: ${{ matrix.versions }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          FLOATING_IMAGE_INDEX_MANIFEST_TAG=$(boil tools floating-tag "${SDP_VERSION}")
+          FLOATING_IMAGE_INDEX_MANIFEST_TAG="${IMAGE_VERSION}-stackable${FLOATING_IMAGE_INDEX_MANIFEST_TAG}"
+
+          echo "FLOATING_IMAGE_INDEX_MANIFEST_TAG=[\"$FLOATING_IMAGE_INDEX_MANIFEST_TAG\"]" | tee -a "$GITHUB_OUTPUT"
+
       - name: Publish and Sign Image Index Manifest to oci.stackable.tech
         id: publish-oci
         if: inputs.publish
@@ -190,6 +222,7 @@ jobs:
           # registry so we don't have to do such gymnastics in the workflow.
           image-repository: ${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}
+          other-image-index-manifest-tags: ${{ case(inputs.floating-tag, steps.extract-floating-tag.outputs.FLOATING_IMAGE_INDEX_MANIFEST_TAG, '[]') }}
 
       - name: Publish and Sign Image Index Manifest to quay.io
         id: publish-quay
@@ -206,6 +239,7 @@ jobs:
           # registry so we don't have to do such gymnastics in the workflow.
           image-repository: stackable/${{ inputs.registry-namespace }}/${{ inputs.image-name || inputs.product-name }}
           canonical-image-index-manifest-tag: ${{ matrix.versions }}-stackable${{ inputs.sdp-version }}
+          other-image-index-manifest-tags: ${{ case(inputs.floating-tag, steps.extract-floating-tag.outputs.FLOATING_IMAGE_INDEX_MANIFEST_TAG, '[]') }}
 
   notify:
     name: Failure Notification
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c6a93ec6f..ab3b2403c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,7 +43,7 @@ repos:
       - id: ruff-format
 
   - repo: https://github.com/rhysd/actionlint
-    rev: e7d448ef7507c20fc4c88a95d0c448b848cd6127 # 1.7.8
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # 1.7.12
     hooks:
       - id: actionlint
 

From cb487c5cc9c580e3ddde11f49948612602763f34 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 12:41:48 +0200
Subject: [PATCH 02/13] ci(krb5): Wire up floating tag support

---
 .github/workflows/build_krb5.yaml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index c8322ef55..0f578de5a 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -11,6 +11,11 @@ on:
         type: boolean
         required: true
         default: false
+      floating-tag:
+        description: Produce floating tag
+        type: boolean
+        required: true
+        default: false
   schedule:
     - cron: 0 2 2/2 * * # https://crontab.guru/#0_2_2/2_*_*
   push:
@@ -40,8 +45,13 @@ jobs:
       id-token: write
       contents: read
     with:
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
       product-name: krb5
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
+      # NOTE (@Techassi): Temporarily hard-code the SDP version
+      sdp-version: 1.2.3
       registry-namespace: sdp
       # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      # Default to false if not set/empty (if not triggered by workflow_dispatch)
+      floating-tag: ${{ case(inputs.floating-tag, true, false) }}

From c62f5006f9ad6fb5d3f79bb7d01676061b2e0e43 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 12:47:09 +0200
Subject: [PATCH 03/13] ci(krb5): Change publish input handling

---
 .github/workflows/build_krb5.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 0f578de5a..28642ca4e 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -6,11 +6,11 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
         type: boolean
         required: true
-        default: false
+        default: true
       floating-tag:
         description: Produce floating tag
         type: boolean
@@ -53,5 +53,6 @@ jobs:
       sdp-version: 1.2.3
       registry-namespace: sdp
       # Default to true if not set/empty (if not triggered by workflow_dispatch)
+      publish: ${{ case(inputs.publish, true, true) }}
       # Default to false if not set/empty (if not triggered by workflow_dispatch)
       floating-tag: ${{ case(inputs.floating-tag, true, false) }}

From 1e1ec98c695dd53bd6471704d7b77a685aba1086 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 12:50:16 +0200
Subject: [PATCH 04/13] ci(krb5): Adjust case() inputs

---
 .github/workflows/build_krb5.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 28642ca4e..324fdd8c8 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -53,6 +53,6 @@ jobs:
       sdp-version: 1.2.3
       registry-namespace: sdp
       # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ case(inputs.publish, true, true) }}
+      publish: ${{ case(inputs.publish, inputs.publish, false) }}
       # Default to false if not set/empty (if not triggered by workflow_dispatch)
-      floating-tag: ${{ case(inputs.floating-tag, true, false) }}
+      floating-tag: ${{ case(inputs.floating-tag, inputs.floating-tag, false) }}

From 421234014b1398b4a03b669ce570047ad681c6ef Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 13:00:03 +0200
Subject: [PATCH 05/13] ci(krb5): Temporarily trigger on PRs

---
 .github/workflows/build_krb5.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 324fdd8c8..ff0be0711 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -18,6 +18,11 @@ on:
         default: false
   schedule:
     - cron: 0 2 2/2 * * # https://crontab.guru/#0_2_2/2_*_*
+  # NOTE (@Techassi): Temporarily enable builds on PR to test if the workflow works when triggered
+  # without inputs.
+  pull_request:
+    paths:
+      - .github/workflows/build_krb5.yaml
   push:
     branches: [main]
     tags:
@@ -53,6 +58,7 @@ jobs:
       sdp-version: 1.2.3
       registry-namespace: sdp
       # Default to true if not set/empty (if not triggered by workflow_dispatch)
+      # TODO (@Techassi): Set the default back to true
       publish: ${{ case(inputs.publish, inputs.publish, false) }}
       # Default to false if not set/empty (if not triggered by workflow_dispatch)
       floating-tag: ${{ case(inputs.floating-tag, inputs.floating-tag, false) }}

From 90ee9645116ef5ad803753c2720cc067d3b56c62 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 13:00:39 +0200
Subject: [PATCH 06/13] ci: Use correct setup-tools action

---
 .github/workflows/reusable_build_image.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml
index 0b450b4e3..92cdd20f7 100644
--- a/.github/workflows/reusable_build_image.yaml
+++ b/.github/workflows/reusable_build_image.yaml
@@ -188,7 +188,7 @@ jobs:
       # this should only be a stepping stone towards a more robust solution.
       - name: Install boil
         if: inputs.floating-tag
-        uses: stackabletech/actions/install-tools@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
+        uses: stackabletech/actions/setup-tools@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
         with:
           boil-version: latest
 

From 05bfb48535c5e387f6f12bafc12002a7b54bcac2 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 14:10:55 +0200
Subject: [PATCH 07/13] ci(krb5): Try different method for defaulting

---
 .github/workflows/build_krb5.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index ff0be0711..6a24ab0e1 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -59,6 +59,6 @@ jobs:
       registry-namespace: sdp
       # Default to true if not set/empty (if not triggered by workflow_dispatch)
       # TODO (@Techassi): Set the default back to true
-      publish: ${{ case(inputs.publish, inputs.publish, false) }}
+      publish: ${{ inputs.publish || false}}
       # Default to false if not set/empty (if not triggered by workflow_dispatch)
-      floating-tag: ${{ case(inputs.floating-tag, inputs.floating-tag, false) }}
+      floating-tag: ${{ inputs.floating-tag || false }}

From 014eb74f52f7b69d05a1168ebacfbd5cc238e9ef Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 14:29:31 +0200
Subject: [PATCH 08/13] ci(krb6): Remove temporary code

---
 .github/workflows/build_krb5.yaml | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 6a24ab0e1..046c4f782 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -18,11 +18,6 @@ on:
         default: false
   schedule:
     - cron: 0 2 2/2 * * # https://crontab.guru/#0_2_2/2_*_*
-  # NOTE (@Techassi): Temporarily enable builds on PR to test if the workflow works when triggered
-  # without inputs.
-  pull_request:
-    paths:
-      - .github/workflows/build_krb5.yaml
   push:
     branches: [main]
     tags:
@@ -30,7 +25,7 @@ on:
       - "[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+"
     paths:
       # To check dependencies, run this ( you will need to consider transitive dependencies)
-      # bake --product PRODUCT -d | grep -v 'docker buildx bake' | jq '.target | keys[]'
+      # boil build PRODUCT -d | jq '.target | keys[]' | grep -v 'common--target'
       - krb5/**
       - .github/actions/**
       - .github/workflows/build_krb5.yaml
@@ -50,15 +45,12 @@ jobs:
       id-token: write
       contents: read
     with:
+      product-name: krb5
       # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
       # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
-      product-name: krb5
-      # sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
-      # NOTE (@Techassi): Temporarily hard-code the SDP version
-      sdp-version: 1.2.3
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
       # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      # TODO (@Techassi): Set the default back to true
-      publish: ${{ inputs.publish || false}}
+      publish: ${{ inputs.publish || true }}
       # Default to false if not set/empty (if not triggered by workflow_dispatch)
       floating-tag: ${{ inputs.floating-tag || false }}

From 9c8f5305d0d9decde3fb3e53e2f994c44d47fc5b Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 14:59:50 +0200
Subject: [PATCH 09/13] ci(krb5): Try yet another way of defaulting

This... is... very cumbersome. Thanks GitHub.
---
 .github/workflows/build_krb5.yaml | 51 ++++++++++++++++++++++++++++---
 1 file changed, 46 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 046c4f782..3b7454e23 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -34,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -50,7 +93,5 @@ jobs:
       # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
       sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ inputs.publish || true }}
-      # Default to false if not set/empty (if not triggered by workflow_dispatch)
-      floating-tag: ${{ inputs.floating-tag || false }}
+      publish: ${{ needs.defaults.outputs.publish }}
+      floating-tag: ${{ needs.defaults.outputs.floating-tag }}

From 54faebc13c895b97cfbcbbefeb1be73ef739d14c Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 15:06:14 +0200
Subject: [PATCH 10/13] ci(krb5): Try fromJson to turn output into a proper
 bool

---
 .github/workflows/build_krb5.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 3b7454e23..7a4f693b2 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -93,5 +93,5 @@ jobs:
       # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
       sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      publish: ${{ needs.defaults.outputs.publish }}
-      floating-tag: ${{ needs.defaults.outputs.floating-tag }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}

From 4e86be8baf40d8ab28a47a96e3e05e8ff12923bc Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 15:19:42 +0200
Subject: [PATCH 11/13] ci: Wire up floating tag support in all image workflows

---
 .github/workflows/build_airflow.yaml          | 62 +++++++++++++++++--
 .github/workflows/build_druid.yaml            | 62 +++++++++++++++++--
 .github/workflows/build_hadoop.yaml           | 62 +++++++++++++++++--
 .github/workflows/build_hbase.yaml            | 62 +++++++++++++++++--
 .github/workflows/build_hive.yaml             | 62 +++++++++++++++++--
 .github/workflows/build_java-base.yaml        | 62 +++++++++++++++++--
 .github/workflows/build_java-devel.yaml       | 62 +++++++++++++++++--
 .../workflows/build_kafka-testing-tools.yaml  | 62 +++++++++++++++++--
 .github/workflows/build_kafka.yaml            | 62 +++++++++++++++++--
 .github/workflows/build_nifi.yaml             | 62 +++++++++++++++++--
 .github/workflows/build_omid.yaml             | 62 +++++++++++++++++--
 .github/workflows/build_opa.yaml              | 62 +++++++++++++++++--
 .github/workflows/build_opensearch.yaml       | 62 +++++++++++++++++--
 .../build_opensearch_dashboards.yaml          | 62 +++++++++++++++++--
 .../workflows/build_spark-connect-client.yaml | 62 +++++++++++++++++--
 .github/workflows/build_spark-k8s.yaml        | 62 +++++++++++++++++--
 .github/workflows/build_stackable-base.yaml   | 62 +++++++++++++++++--
 .github/workflows/build_superset.yaml         | 62 +++++++++++++++++--
 .github/workflows/build_testing-tools.yaml    | 62 +++++++++++++++++--
 .github/workflows/build_tools.yaml            | 62 +++++++++++++++++--
 .github/workflows/build_trino-cli.yaml        | 62 +++++++++++++++++--
 .github/workflows/build_trino.yaml            | 62 +++++++++++++++++--
 .github/workflows/build_vector.yaml           | 62 +++++++++++++++++--
 .github/workflows/build_zookeeper.yaml        | 62 +++++++++++++++++--
 24 files changed, 1344 insertions(+), 144 deletions(-)

diff --git a/.github/workflows/build_airflow.yaml b/.github/workflows/build_airflow.yaml
index 5b5e62730..481b1e499 100644
--- a/.github/workflows/build_airflow.yaml
+++ b/.github/workflows/build_airflow.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -31,8 +36,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,7 +91,9 @@ jobs:
       contents: read
     with:
       product-name: airflow
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_druid.yaml b/.github/workflows/build_druid.yaml
index afbf17418..d8f81a633 100644
--- a/.github/workflows/build_druid.yaml
+++ b/.github/workflows/build_druid.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: druid
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_hadoop.yaml b/.github/workflows/build_hadoop.yaml
index e20c598f7..80a8d48c9 100644
--- a/.github/workflows/build_hadoop.yaml
+++ b/.github/workflows/build_hadoop.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: hadoop
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_hbase.yaml b/.github/workflows/build_hbase.yaml
index 8d8ba87e9..04833161f 100644
--- a/.github/workflows/build_hbase.yaml
+++ b/.github/workflows/build_hbase.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,7 +94,9 @@ jobs:
       contents: read
     with:
       product-name: hbase
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_hive.yaml b/.github/workflows/build_hive.yaml
index cd0b31c60..d9e3bc53d 100644
--- a/.github/workflows/build_hive.yaml
+++ b/.github/workflows/build_hive.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,8 +94,10 @@ jobs:
       contents: read
     with:
       product-name: hive
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_java-base.yaml b/.github/workflows/build_java-base.yaml
index 6a6d1d838..d99777efe 100644
--- a/.github/workflows/build_java-base.yaml
+++ b/.github/workflows/build_java-base.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -41,7 +89,9 @@ jobs:
       contents: read
     with:
       product-name: java-base
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_java-devel.yaml b/.github/workflows/build_java-devel.yaml
index 23b6bfa88..583be886f 100644
--- a/.github/workflows/build_java-devel.yaml
+++ b/.github/workflows/build_java-devel.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -41,7 +89,9 @@ jobs:
       contents: read
     with:
       product-name: java-devel
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_kafka-testing-tools.yaml b/.github/workflows/build_kafka-testing-tools.yaml
index 1c9692fcc..a61af127f 100644
--- a/.github/workflows/build_kafka-testing-tools.yaml
+++ b/.github/workflows/build_kafka-testing-tools.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: kafka-testing-tools
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_kafka.yaml b/.github/workflows/build_kafka.yaml
index a0c06e7af..a1b036522 100644
--- a/.github/workflows/build_kafka.yaml
+++ b/.github/workflows/build_kafka.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,7 +94,9 @@ jobs:
       contents: read
     with:
       product-name: kafka
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_nifi.yaml b/.github/workflows/build_nifi.yaml
index 8e46aae84..f6db301cb 100644
--- a/.github/workflows/build_nifi.yaml
+++ b/.github/workflows/build_nifi.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,10 +93,12 @@ jobs:
       contents: read
     with:
       product-name: nifi
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       # Since building Vector from source, this build runs out of disk space.
       # As such, we use the Ubicloud runners which provide bigger disks.
       runners: ubicloud
diff --git a/.github/workflows/build_omid.yaml b/.github/workflows/build_omid.yaml
index 8d1dfb49c..86927555c 100644
--- a/.github/workflows/build_omid.yaml
+++ b/.github/workflows/build_omid.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: omid
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_opa.yaml b/.github/workflows/build_opa.yaml
index f8efdbec4..1e5e0b81d 100644
--- a/.github/workflows/build_opa.yaml
+++ b/.github/workflows/build_opa.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -31,8 +36,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,7 +91,9 @@ jobs:
       contents: read
     with:
       product-name: opa
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_opensearch.yaml b/.github/workflows/build_opensearch.yaml
index 8cbcd506f..359bcae8f 100644
--- a/.github/workflows/build_opensearch.yaml
+++ b/.github/workflows/build_opensearch.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,8 +94,10 @@ jobs:
       contents: read
     with:
       product-name: opensearch
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_opensearch_dashboards.yaml b/.github/workflows/build_opensearch_dashboards.yaml
index 64f066228..29c495de5 100644
--- a/.github/workflows/build_opensearch_dashboards.yaml
+++ b/.github/workflows/build_opensearch_dashboards.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -32,8 +37,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -44,8 +92,10 @@ jobs:
       contents: read
     with:
       product-name: opensearch-dashboards
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_spark-connect-client.yaml b/.github/workflows/build_spark-connect-client.yaml
index 20b3d649b..7db27ab23 100644
--- a/.github/workflows/build_spark-connect-client.yaml
+++ b/.github/workflows/build_spark-connect-client.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -32,8 +37,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,11 +91,13 @@ jobs:
       contents: read
     with:
       product-name: spark-connect-client
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: stackable
       # Since building Vector from source, this build runs out of disk space.
       # As such, we use the Ubicloud runners which provide bigger disks.
       runners: ubicloud
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       publish-to-quay: false
diff --git a/.github/workflows/build_spark-k8s.yaml b/.github/workflows/build_spark-k8s.yaml
index 45cd9cd95..1ad8993ce 100644
--- a/.github/workflows/build_spark-k8s.yaml
+++ b/.github/workflows/build_spark-k8s.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -34,8 +39,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -46,8 +94,10 @@ jobs:
       contents: read
     with:
       product-name: spark-k8s
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       runners: ubicloud
diff --git a/.github/workflows/build_stackable-base.yaml b/.github/workflows/build_stackable-base.yaml
index e73f1252e..c7e5bd29c 100644
--- a/.github/workflows/build_stackable-base.yaml
+++ b/.github/workflows/build_stackable-base.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -30,8 +35,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -42,7 +90,9 @@ jobs:
       contents: read
     with:
       product-name: stackable-base
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_superset.yaml b/.github/workflows/build_superset.yaml
index 6123510d9..9d4f8b0fb 100644
--- a/.github/workflows/build_superset.yaml
+++ b/.github/workflows/build_superset.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -31,8 +36,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -43,7 +91,9 @@ jobs:
       contents: read
     with:
       product-name: superset
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_testing-tools.yaml b/.github/workflows/build_testing-tools.yaml
index 1793eeab1..764aebf8a 100644
--- a/.github/workflows/build_testing-tools.yaml
+++ b/.github/workflows/build_testing-tools.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow (${{ matrix.product-name }})
+    name: Build Image(s) (${{ matrix.product-name }})
+    needs: [defaults]
     strategy:
       fail-fast: false
       matrix:
@@ -49,7 +97,9 @@ jobs:
       contents: read
     with:
       product-name: ${{ matrix.product-name }}
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_tools.yaml b/.github/workflows/build_tools.yaml
index c68762747..0b1914a18 100644
--- a/.github/workflows/build_tools.yaml
+++ b/.github/workflows/build_tools.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -30,8 +35,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -42,7 +90,9 @@ jobs:
       contents: read
     with:
       product-name: tools
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_trino-cli.yaml b/.github/workflows/build_trino-cli.yaml
index 5dc3260a1..3bcf0fe8b 100644
--- a/.github/workflows/build_trino-cli.yaml
+++ b/.github/workflows/build_trino-cli.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -32,8 +37,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -44,7 +92,9 @@ jobs:
       contents: read
     with:
       product-name: trino-cli
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_trino.yaml b/.github/workflows/build_trino.yaml
index 0ad8ea84e..0028b2824 100644
--- a/.github/workflows/build_trino.yaml
+++ b/.github/workflows/build_trino.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,10 +93,12 @@ jobs:
       contents: read
     with:
       product-name: trino
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
       # Since building Vector from source, this build runs out of disk space.
       # As such, we use the Ubicloud runners which provide bigger disks.
       runners: ubicloud
diff --git a/.github/workflows/build_vector.yaml b/.github/workflows/build_vector.yaml
index a9db48545..57b6c4342 100644
--- a/.github/workflows/build_vector.yaml
+++ b/.github/workflows/build_vector.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -29,8 +34,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -41,7 +89,9 @@ jobs:
       contents: read
     with:
       product-name: vector
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}
diff --git a/.github/workflows/build_zookeeper.yaml b/.github/workflows/build_zookeeper.yaml
index f4b62939f..a76e11c92 100644
--- a/.github/workflows/build_zookeeper.yaml
+++ b/.github/workflows/build_zookeeper.yaml
@@ -6,8 +6,13 @@ run-name: |
 on:
   workflow_dispatch:
     inputs:
-      skip-publish:
-        description: Skip publishing and signing images
+      publish:
+        description: Publish and sign images
+        type: boolean
+        required: true
+        default: true
+      floating-tag:
+        description: Produce floating tag
         type: boolean
         required: true
         default: false
@@ -33,8 +38,51 @@ on:
 permissions: {}
 
 jobs:
+  # This whole dance is only needed because GitHub Actions has no straight forward way of setting
+  # default values for inputs which are not present due to the workflow being triggered by a
+  # different event (workflow_dispatch vs push). Approaches tried (and used) in the past:
+  #
+  # - Negate the input (publish -> skip-publish) and use ${{ !inputs.skip-publish }} for the reusable
+  #   workflow. This works, but only by luck and it is cumbersome to wrap your head around.
+  #   We generally prefer non-negated terms for inputs.
+  # - Use ${{ inputs.publish || true }}, but that results in 'true' even when the workflow is
+  #   dispatched with 'false' via the UI.
+  # - Use ${{ case(inputs.publish, inputs.publish, true) }}, but that fails as well, because the
+  #   predicate must evaluate to a boolean value and apparently doesn't if the input is not present.
+  defaults:
+    name: Determine Defaults
+    runs-on: ubuntu-latest
+    outputs:
+      floating-tag: ${{ steps.defaults.outputs.FLOATING_TAG }}
+      publish: ${{ steps.defaults.outputs.PUBLISH }}
+    steps:
+      - id: defaults
+        shell: bash
+        env:
+          INPUT_FLOATING_TAG: ${{ inputs.floating-tag }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+        run: |
+          set -euo pipefail
+
+          # Default to false if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_FLOATING_TAG:-}" ]; then
+            echo "FLOATING_TAG=false" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "FLOATING_TAG=${INPUT_FLOATING_TAG}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+          # Default to true if not set/empty (if not triggered by workflow_dispatch)
+          # Keep this default value in sync with the default value specified for workflow_dispatch!
+          if [ -z "${INPUT_PUBLISH:-}" ]; then
+            echo "PUBLISH=true" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PUBLISH=${INPUT_PUBLISH}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
   build_image:
-    name: Reusable Workflow
+    name: Build Image(s)
+    needs: [defaults]
     uses: ./.github/workflows/reusable_build_image.yaml
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
@@ -45,7 +93,9 @@ jobs:
       contents: read
     with:
       product-name: zookeeper
-      sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
+      # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
+      # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
-      # Default to true if not set/empty (if not triggered by workflow_dispatch)
-      publish: ${{ !inputs.skip-publish }}
+      publish: ${{ fromJson(needs.defaults.outputs.publish) }}
+      floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}

From d50379768032650b705d83f6d87625f0121afed9 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 15:55:52 +0200
Subject: [PATCH 12/13] ci(krb5): Temporarily hard-code version for testing

---
 .github/workflows/build_krb5.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 7a4f693b2..132871006 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -91,7 +91,10 @@ jobs:
       product-name: krb5
       # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
       # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
-      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
+      # sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
+      # TODO (@Techassi): Temporarily use hard-coded version to produce floating tag- Remove again.
+      sdp-version: 1.2.3
+      publish-to-quay: false # Cleanup is easier if we only push to Harbor for e2e testing.
       registry-namespace: sdp
       publish: ${{ fromJson(needs.defaults.outputs.publish) }}
       floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}

From 5d05bcd942ae2b9c9e34df346537c83be56ad7c8 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Wed, 2 Sep 2026 16:06:12 +0200
Subject: [PATCH 13/13] Revert "ci(krb5): Temporarily hard-code version for
 testing"

This reverts commit d50379768032650b705d83f6d87625f0121afed9.
---
 .github/workflows/build_krb5.yaml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
index 132871006..7a4f693b2 100644
--- a/.github/workflows/build_krb5.yaml
+++ b/.github/workflows/build_krb5.yaml
@@ -91,10 +91,7 @@ jobs:
       product-name: krb5
       # Syntax for case(): predicate, value if predicate is true, (more predicate+value pairs), default value
       # See https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#case
-      # sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
-      # TODO (@Techassi): Temporarily use hard-coded version to produce floating tag- Remove again.
-      sdp-version: 1.2.3
-      publish-to-quay: false # Cleanup is easier if we only push to Harbor for e2e testing.
+      sdp-version: ${{ case(github.ref_type == 'tag', github.ref_name, '0.0.0-dev') }}
       registry-namespace: sdp
       publish: ${{ fromJson(needs.defaults.outputs.publish) }}
       floating-tag: ${{ fromJson(needs.defaults.outputs.floating-tag) }}