diff --git a/.github/workflows/docker-build-scan.yaml b/.github/workflows/docker-build-scan.yaml
index c02d29f0b797b..67c59a8fe90b3 100644
--- a/.github/workflows/docker-build-scan.yaml
+++ b/.github/workflows/docker-build-scan.yaml
@@ -25,6 +25,8 @@ jobs:
 
   build-cel2-migration-tool:
     runs-on: ubuntu-latest
+    env:
+      GIT_COMMIT: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
     needs: detect-files-changed
     if: |
       contains(needs.detect-files-changed.outputs.files-changed, 'go.sum') ||
@@ -49,7 +51,7 @@ jobs:
         with:
           platforms: linux/amd64
           registry: us-west1-docker.pkg.dev/devopsre/dev-images/cel2-migration-tool
-          tags: ${{ github.sha }}
+          tags: ${{ env.GIT_COMMIT }}
           context: ./
           dockerfile: ./op-chain-ops/Dockerfile
           push: true
@@ -73,9 +75,9 @@ jobs:
       id-token: write
       security-events: write
     env:
-      GIT_COMMIT: ${{ github.sha }}
+      GIT_COMMIT: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       GIT_DATE: ${{ github.event.head_commit.timestamp }}
-      IMAGE_TAGS: ${{ github.sha }},latest
+      IMAGE_TAGS: ${{ (github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/celo')) && 'latest,' || '') }}${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       REGISTRY: us-west1-docker.pkg.dev
       REPOSITORY: blockchaintestsglobaltestnet/dev-images
     steps: